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April 16, 2014 

BY ECF 

The Honorable Loretta A. Preska 
Chief Judge 

United States District Court 
500 Pearl Street 
New York, NY 10007 

Re: United States v. Jeremy Hammond 
12 Cr. 185 (LAP) 

Dear Judge Preska: 

The government has completed its redactions of Exhibit H, which it 
sent to defense counsel last week. The parties agree that the new version 
complies with the Courts protective order. 

This filing is intended to supplement the re-redacted submissions 
filed on January 7, 2014. 

Thank you for your kind attention to this letter. 

Respectfully submitted, 




Susan G. Kellman 
Sarah Kunstler 

Attorneys for Jeremy Hammond 

cc: Rosemary Nidiry 

Asst. United States Attorney 



Jeremy Hammond 
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Law Offices of Susan G. Kellman 

25 EIGHTH AVENUE • BROOKLYN, NEW YORK 11217 
(7 1 8)783-8200* FAX (7 1 8) 783-8226 • KELLMANESQ@AOL.COM 
FELLOW, AMERICAN COLLEGE OF TRIAL LAWYERS 

November 1,2013 

The Honorable Loretta A. Preska 
Chief Judge 

Southern District of New York 
500 Pearl Street 
New York, NY 10007 



Re: United States v. Jeremy Hammond 
12 Cr. 185 (LAP) 

Dear Judge Preska 

Please accept this letter as an addendum to our sentencing submission on 
behalf of Mr. Jeremy Hammond. 

We have devoted a large portion of our main submission to Mr. Ham- 
mond's motivations and other relevant Section 3553(a) factors. In the course of 
reviewing the discovery in this case, it has become clear that the Stratfor hack 
and the relevant conduct to which Mr. Hammond pled guilty are only part of the 
story, and that there are additional hacks and conduct by Mr. Hammond that are 
appropriate for the Court's consideration under 18 U.S.C. § 3553(a) as they are 
part of the nature and circumstances of the offense and they provide the contex- 
tual framework for the Court's overall consideration of Mr. Hammond's intentions 
and motivation. 1 

Following the Stratfor hack, Mr Hammond, through the governments 
agent Hector Monsegur, aka "Sabu," was asked to hack a number of websites 
and computer servers outside of the United States. Mr. Monsegur supplied lists 
of targets, which included numerous foreign government websites and affected 
over 1000 domains, 2 



Since much of the substance contained in this submission is arguably within 
the limitations set by the Protective Order in place, in an excess of caution, we 
are filing a redacted version on ECF, but will provide Chambers and 
government counsel with this unredacted submission. 

Many of these target websites utilized the popular Plesk web-hosting 
software and were subject to a hidden vulnerability, which only Jeremy 
Hammond a few others had the tools to access. This vulnerability permitted 
attackers to access and control the servers remotely. 



1 
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Foi^xample, on January 23, 2012, Mr. Monsegur^ave Mr. Hammond a 
list of | | government targets to "hit.. .for ou| | squad." Mr. 
Hammond hacked one of the targets and showed Monsegur that it contained 287 
domains and 1330 different email accounts. Mon segur to ld Hammond that 
(1 havitja...our boy thats been dosing and hacking] (past few days gonna 
handle it. 3 " 

Upon information and belief, access to the site^as then passed on to 
Havittaja, who used the information to target the m| government and its 
institutions. 4 After Mr. Monsegur was publicly rev^le^s a government 
cooperator, a person who was identified as the( (hacker Havittaja 
published what he/she claimed was a portion of his/her chat room 
correspondence with Monsegur on the internet. 5 The question Havittaja asked is 
"why was he giving me passwords if he was with the FBI?" 

Mr. Hammond accepts full responsibility for his unlawful conduct, and 
nothing in this letter is intended to minimize or detract from his responsibility for 
the actions that he took. Nonetheless, the question raised by Havittaja is a valid 
one. Why was our government, which presumably controlled Mr. Monsegur dur- 
ing this period, using Jeremy Hammond to collect information regarding the vul- 
nerabilities of foreign government websites and in some cases, disabling them? 
This question is especially relevant today, amidst near daily public revelations 
about governments' efforts, worldwide, to monitor the communications of, and 
gather intelligence on, world leaders. 

The discovery in this case, further reveals that while cooperating with the 
government, Mr. Monsegur challenged Mr. Hammond to access many 




Over the course of numerous chat logs, Mr. Monsegur, presumably under 
The online pseudonym of this hacker is actually "Havittaja." 
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government direction, repeatedly asked Mr. Hammond to provide passwords or 
root backdooynformation to access these sites. In some cases, as with at least 
som^nte^JJBtargets, which were passed on to Havittaja^n^ome of 
theBHBBar^ets^nich appear to have been passed on to a| [hacking 

group known as "Red Hack," it appears as though the United States government 
was actively facilitating the hacking of foreign government websites. In other 
cases, Mr. Hammond provided site access information to Mr. Monsegur, but it is 
unclear if any action was taken, or what, if any, intelligence information was 
collected by the United States. It is possible that some of these vulnerabilities 
mined by Mr. Hammond, at Mr. Monsegur's direction, still exist, and that the 
government possesses the means to access these sites. 

We have attached, for the Court's review, a summary of the discovery ma- 
terials that relate to this activity, as well as the bate stamped pages of discovery 
that corresponds to this summary. 

Thank you for your kind consideration of these materials. 



Respectfully submitted, 




Susan G. Keiiman 
Sarah Kunstier 

Attorneys for Jeremy Hammond 
25 Eighth Avenue 
Brooklyn, New York 11217 
(718) 783-8200 
kellmanesq@aol.com 

cc: AUSA Rosemary Nidiry 
AUSA Thomas Brown 
Susan P. Matthews, USPO 



Jeremy Hammond 
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DISCOVERY TIMELINE PERTAINING TO HACKS OF FOREIGN WEBSITES 
01/23/12 

• Mr. Monsegur gives Mr. Hammond^^^^J (targets with Plesk vulnerabilties 1 
and asks him to "hit these... ior ou^^^^Jquad?' (BS 104988 - 104989) 

• Hammond hacks one of these targets and shows Monsegur the site contains 287 
dc^^^^^j 1330 different email accounts. Monsegur says he will give these targets 
to| macker "Hivitja" (actually Havittaja) to hack the sites. Monsegur tells 
HammoncHo create a root backdoor ("just backdoor uris") so the sites can be 
accessed again. Hammond also gives Monsegur passwords for some of the sites. 2 
(BS 104989- 104990) 

• Monsegur identifies additional targets for Hammond. Hammond confirms that he 
successfully gainec^cces^c^wo of therr^One of the servers contairi^52^inmains, 
many of them sn| (and | | Another contains 392( 

domains. (BS 104991-105013) ^^^^ 

• Hammond explains to Monsegur how to use root backdoors and where to find the 
email and databases. (BS 105013-105014) 

• Monsegur says he is finding more targets ("finding new juicy targets") and asks for root 
backdoor instructions again, which Hammond provides. (BS 105014) 

• Monsegur provides Hammond with targets in | | Hammond gains access to one 
that contains 62 domains and 96 email accounts. (BS 105028-105029) 

• Monsegur provides more international targets, says he is "looking for embassys [sic] 
and consulates" [sic]. Hammond provides access to two of them. (BS 105029-105030) 

• Monsegur asks Hammond to access a( |site, but he is unable to gain access. 
(BS 105041) 

• Monsegur gives Hammond more | (targets, including (which he 

describes as a "big target" Hammond provides passwords. (BS 105041-105042) 

• Monsegur provides more| (targets. Hammond gains access to one of them and 
provides the password, as requested. (BS 105044-105046) 




1 In the discovery, Plesk vulnerabilities are indicated with the 
vulnerable port on Plesk websites. 

2 For sites that ran on Linux, Mr. Hammond was able to provide backdoors. For 
W indows-based s ite s, he was only able to provide passwo rds for administrative access. 

media conglomerate and thel 




1 
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1/25/12 



MonsRflu r provides a long list of targets from many different international countries 
^^^^^ 

^^^^^^^^^^^^(BS 105061-105063) 

Monsegur teils Hammond that he will giv^he^H^government sites to a| 
hacking group known as RedHack ("the(BpBvil[be handled RedHack famous 
BHHBhackers" ) and tells Hammond thaHnesites he has given him are "high priority" 
-- as if he were placing an order. (BS 105063) 

Mon|gaur invites Hammond to the RedHack channel so Ha mmond c an provide the 
Bsites ("accept invite"). Monsegur also provides more( (domains (BS 

105065-105066) 



Hammond tells Monsegur that one of the servers has mail for 22 1 
domains and another has mail for about 600 domains. (BS 105067.) 



Government 



Monsegur creates a chat room and invites Hammond and an alleged member of 



RedHack. They exchange information regarding thousands O" 
62889) 




Sites. (BS 



Ham mond exp lains to the alleged Redhack member how to access the root backdoors 
of the( (sites^ (BS 62889-62897) 



1/26/12 



Monsegur follows up on foreign government targets he provided to Hammond "last 
night." Hammond s ends back a list of the sites he did not gain access to, including 
jovernment sites in | 

|(BS 105077-105078) 

Monsegur asks for the list again. Monsegur again asks for instructions on how to 
access root backdoors. Hammond gives Monsegur the information (BS 105080- 
105081) 




Monsegur provides two| 
passwords. (BS 105088) 



| government targets and asks Hammond to provide 



Monsegur provides more( (targets tc^hich he wants access. (Monsegur: "lend 
me an hour of your time to bang out thesej | targets.") Hammond gains access to 
one that hosts 7 domains and 56 email accounts. (BS 105091) 



Monsegur provides two targets in 




Hammond cannot gain access to either. (BS 



2 
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105091-105092) 



2/2/12 



• Monsegur provides morcyara^ and 
government in | |Mr. Monsegur asks 

again for instructions on how to access root backdoors. (BS 105152) 



• Monsegur provides taraets in | | Hammond 

acceses one of the! Kites that contains 135 domains and 287 email accounts (BS 
105157-105159) 



2/15/12 



• Monsegur provides targets i| |He tells Hammond that these sites are for 
"tony, the guy who hacked kingcope" (BS 67593-67594) 

• Monsegur tells Hammond he is "setting up a new box to serve as another tor onion for 
us as a third backup" and says "I want us to have redundant backups for all our shit." 
(BS 67594-67595) 

• Hammond provides access to some of the| (sites. He creates three backdoors 
and tells Monsegur that they contain hundreds of domains and emails, Hammond 
comments "hopefuiyl were getitngs omething out of all this" and Monsegur responds 
"trust me... everything i do serves a purpose ;P" (BS 67597) 



3 
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EXHIBIT 1 - NEWS REPORT ON 



HACKS 
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EXHIBIT 2 - ALLEGED STATEMENT BY HAVITTAJA 



10/31/13 
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Pastebin.com - fainted Paste ID: hup://pastebin.com/pqj,roeV3n 
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5. 

6, 
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35 J 

36 J 



24/01/2012 

https : //twitter. com/Havittaj a 

htt ps : //twitte r . com/ theevilc0de 

One of the last conversations with Sabu. 

WHAT REALLY SABU WAS DOING, 

A QUESTAO E porque ele estava me dando senhas se ele estava com o FBI? 
THE QUESTION IS why he was giving me passwords if he was with the FBI? 

censored password obvious reasons 



18:51 
18:51 
18:51 
18:52 
18:52 
18:52 
18:52 
18:52 
18:52 
18:52 
18:52 
18:52 
18:52 
18:52 
18:53 
the root 
18:53 
18:53 
18:53 
18:53 
18:53 
18:54 
18:54 
18:54 
18:54 
18:55 



Havittaja 
Sabu my 
Havittaja 
Havittaja 
Sabu FTP: 
Sabu 
Sabu 

Sabu root: 
Sabu 
Sabu 
Sabu 
Sabu 
Havitta 
Havittaja 



hey 
brother!!! 

what's happen 



ensored 




Sabu 

Sabu 
Sabu 
Sabu 
Sabu 

Havitta j a 
Havittaja 
Havittaja 
Sabu ok 
Sabu the 
Havittaja 



its for me ? 
showed la la/ha rd366 as well 



for admin password 



but I don't think they'll do something with 



37. 




38, 


ftp: 


39, 


ftp: 


48. 


ftp: 


41. 


ftp: 


42, 


ftp: 


43. 


ftp: 


44. 


ftp: 


45. 


ftp: 


46. 


ftp: 


47. 


ftp: 



also 

for the first 2, they're on the same server with hundreds of Hi domains 
you have control of them. I can give you the xral file with all passwords 
want them? 

hm sure 

so i'll wait evilc0.de 
we working together 

most important is the 
oky 

ser: censored pass: censored 
s: censored 

ser: censored pass: censored 

user: censored pass: censored 

censored pass: censored 
censored pass: censored 
r: censored pass: censored 
I user: censored pass: censored 
suser: censored pass: censored 
user: censored pass: censored 




pastebin.com'print.php?i=pqimeV3n 
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Conversation with yohoho@jabber.ccc.de at 2/15/2012 4:44:14 PM on 
LeonDavidson@jabber.org/jabbet\org (jabber) 

(4:44: 19 PM) leondavid$O0@jabber,org/jabber.0rg: what up broham 

(4:44:32 PM) yohoho@j abbenccc.de: yoyo 

(4:44:40 PM) yohoho@jabber.ccc.de: hackin and crackin u??? 

(4:45:14 PM)leondavidson@jabber.org/jahber.org: about to take a nap 

(4:45:20 PM) yohoho@jabber.ccc.de: nice, nice 

(4:45:4i PM) leondavidson@jabbt;r.org/jabber,org; my schedule is fucked plus works beating 
my ass 

(4:45:54 PM) IeondaYtdsQn@jabber.org/jabber.org: I missed th^ | defacement 

the other night ya nig! 

(4:46:38 PM) leondavidson@jahber.org/jabber,org: couple of tilings: 

(4:46:39 PM) yohoho@jabber.ccc.de; yeah 

(4:46:40 PM) yohoho@jabber.ccc.de: well 

(4:46:43 PM) yohoho@jabber.ccc.dc: I had to hit it hard 

(4:46:46 PM) yohoho@jabbcr.ccc.de: admins started removing backdoors 

(4 ; 4(3;59 PM) yohoho@jabber.ccc.de: they removed my password loggers and shit 

(4:47:02 PM) yohoho@jabber.ccc.de: so I had to go fast 

(4:47:10 PM) Ieondavidson@jabber.9rg/jabber.org: mhm 

(4:47:15 pm) leondavidson@jabber.org/jabber.org: tats what elche told me 

(4:47:17 PM) le0Mdavidson@jabher.org/jabber.org: thats whats up 

(4:47:20 PM) leondavidson@jabher.org/jabber.org: it worked out actually 

(4:47:58 PM) yohoho@jabber.ccc.de: good thing it ended up being timed great 

(4:47:33 PM) leondavidson@jabber.org/jabber.org: I guess shit happens for a reason, that box 

was just too full of holes 

(4:47:39 PM) ieondavid$on@jabber.org/jabber.org: fucking fckeditor hole is a joke 
(4:47:43 Pmj lcondavidson@jabber.org/jabber.org: for a company HkeB 
(4:47:44 PM) yohoho@jahber.ccc.de: for real 

(4:47:52 PM) yohoho@jabber.ccc.de: that's how becca's other sites got hacked too 

(4:47:57 PM) yohoho@jabber.ccc.de: according to the last email on that defacement 

(4:48:00 PM) leoadavidson@jabber.org/jabber.org: mhm 

(4:48:1 1 PM) yohoho@jabber.ccc.de: she just got fired from her other job 

(4:48:24 PM) leondavidson@jabber.org/jabber.org: that sucks 

(4:48:25 PM) yohoho@jabber.ccc.de: I still have one of her email addresses 

(4:48:27 PM) Ieondavidson@jabber.org/jabber.org: aha fed bad for her 

(4:48:33 PM) yohoho@jabber.ccc.de: well 

(4:48:37 PM) yohoho@jabber.ccc.de: she obviously knew whcj^-s as 
(4:4$:4i PM) leoadavidson@jabber.org/jabber.org: jea 

(4:48:44 pm) yohoho@jabber.ccc.de: because in her emails she showed hesitation 
(4:48:46 PM) yohoho@jabber.ccc.de: about working fo rhtem 
(4:48:49 pm) yohoho@jabber.ccc.de: but she did it anyway 

(4:49:24 pm) yohoho@jabber.ccc.de: she's honestly lucky we didn't post both of her mail spools 
(4:49:28 PM) yohoho@jabber.ccc.de: she has dating profiles and everything 
(4:49:32 PM) yohoho@jabber.ccc.de: eharmony, pientyoffish 
(4:49:39 pm) leondavidson@jabber.org/jabber.org: she hot? 
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(4:49:48 PM) yohobo@jabbenccc.de: I didn't look at her profile actually 

(4:49:53 PM) Ieondavidson@jabber.0rg/jabber.urg: haha 

(4:49:55 PM) yohobo@jabber.ccc.de: you dirty bastard =p 

(4:49:58 PM) Ieondavidsoii@jabber.0rg/jabber.0t*g: yo a few things brother 

(4:50:00 PM) leondavid$an@jabber.org/jabber.org; first 

(4:50:09 PM) leondavidson@jabber.org/jabber.org: h's boy has plesk bug as you know 

(4:50:12 PM) leondavids0n@jabfoer.org/jabber.org: so he messages me with: 

(4:50:19 PM) leondavidson@jabber.0rg/jabber.org: 5:48 <bfl> yo 

1 5:48 <bfl> you around? 

1 5:48 <bf i | |is vuln 

15:48 <bfl> its running plesk 

15:49 <bfl> i just found it during a search 

15:49 <bfl> ;) 

(4:50:22 PM) yohoho@jabber.ccc.de: h's boy ? 

(4:50:24 pm) !eottdavidson@jabber.0rg/jal>ber,org; so makes sense we tell him to leave it alone 

(4:50:28 PM) leondavidson@jabber.org/jabber.org: yes. bf7bfl 

(4:50:30 PM) yohoho@jabber.ccc.de: fuck 

(4:50:32 PM) teondavMson@jabber.org/jabber.Grg: thats h's boy 

(4:50:34 PM) yohoho@jabber.ccc.de; we already have that box 

(4:50:40 PM) yohoho@jabber.ccc.de: damnit 

(4:50:43 PM) yohoho@jabber.ccc.de: maybe we should hit it on friday 

(4:50:48 PM) leoudavid$on@jabber.org/jabber.org: I'll tell him to leave it alone, but you never 
know ... 

(4:50:49 PM) leondavidson@jabber.org/jabber.org: its tainted 

(4:50.53 PM) leondavidson@jabber.Grg/jabber.org: fee me 

(4:50:55 PM) Ieondavidson@jabber.org/jabber.org: feel* 

(4:50:56 PM) yohoho@jabber.ccc.de: let's hit it on friday 

(4:50:59 PM) leondavidso»@jahber.org/jabfaer.org: kk 

(4:51:00 PM) leondavidson@jabber.org/jabber.org: another thing 

(4:51:05 PM) leondavidson(j|jjabber.org/jabber.org: had a very long talk with kingcope 

(4:51:06 PM) yohoho@jabber.ccc.de: we need a FFF from now on 

(4:51:09 PM) yohoho@jabber.ccc.de: yes? 

(4:51:11 PM) ieondaYidsoti@jabber.org/jabber.org: he sends his love to our team 
(4:51:14 PM) feondavid$on@jabber.org/jabher.org: he says thank you 
(4:51:19 PM) yohoho@jabber.ccc.de: that is awesome 

(4:51:20 PM) Ieondavidson@jabber.org/jabber.org: that "we need this to happen" 
(4.51:24 PM) Ieondavidson@jabber.org/jabber.org: and 

(4:51 :32 PM) lcandavid$on@jabber,0rg/jabber.org; he's sending us research asap that is not 
paid for 

(4:51 :37 PM) leondavidson@jabber.org/jahb6r.arg: sadly his remote mysql Oday = paid work 
(4:51 :42 PM) Ieondavidson@jabber.org/jabber.Grg: he cant send it to us out of respect 
(4:53 ;46 PM) Ieondavid$on@jabber,org/jabber.org; but he has other shit ^^^^^ 
(4:52:38 PM) leondavLdson@jahber.0rg/jabbei\org: got a few requests fromj |>roters. 
give me a minute 

(4:53:16 PM) Ieoudavidsoii@f abber.org/jabber.org: another thing 
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(4:53:26 PM) lcondavidson@jabber.or^jabber.o:rg: LoD send us complete source codes for 
nor ton anti-virus: 

/iabber.org: 20:39 <LoD> 

20:39 <LoD: 
20:39 <LoD: 
20:39 <LoD>| 
20:39 <LoD: 
20:39 <LoD: 

(4:53:43 PM) yoboho@jabber.ccc.de; oh wow 

(4:53:4? PM) yohoho@jabber.ccc.de: what are we going to do about that ? 

(4:53:56 PM) leo!idavidson@jabber.org/jabber.org: they asked me to promsie we doont release 

it 

(4:53:58 PM) yohoho@jabber.ccc.de: I understand about the mysql shit 
(4:53:59 PM) teonda\idsors@jabber.org/jabbGr.org; but to use it for our research 
(4:54:03 PM) yohoho@jabber.ccc.de: ok so what are we going to do, audit it? 
(4:54:07 PM) leondavidson@jabber.org/jabber.org: malware research 
(4:54:08 PM) Ieondavidson@jabber,org/jabber.org; yup 

(4:54: i8 PM) yohoho@jabber.ccc.de: we might need someone who ahs a lot of time and 
experience with this 

(4:54:22 PM) yohoho@jabber.ccc,de: im not the right person 

(4:54:33 PM) yohoho@jabber.ccc.de: and also I'm putting alex to work on some shit as well 
(4:54:52 PM) yohoho@jabber.ccc.de: oh ok wait 
(4:54:52 PM) yohoho@jabber.ccc.de: bf 

(4:54:55 pm) lcondavidson@jabber.org/jabber.org: thats fine. I'm just sendning you the data to 
have just in. case 

(4:54:55 PM) yohoho@jabber.ccc.de: is blowfish ? 

(4:54:56 PM) yohoho@jabber.ccc.de: foof ? 

(4:55:00 PM) leondavidson@jabber,org/jabber.org: nein 

(4:55: 10 pm) leondavidson@jabber.org/jabber.org: hes the kid that sent us all thse ,mil.,gov 
logins 

(4:55: 1 1 PM) yohoho@jabber,ccc.de; hmm ok because blowfish works with revolusec and knwos 
about plesk but he doesn't have the sploit 
(4,55:16 PM) yohoho@jabber.ccc.de: oh right 

i ieondavirisoaiftuabber.Org/iahber.org:l 




(4:57:27 pm) yohoho@jabber.ccc.de: ok let me take j 
(4:57:37 PM) teondavMson(&jabher.or|^iabber a org 




(4:57:40 PM) yohoho@jabber.ccc.de: also 

(4:57:43 PM) leondavidsoii@jabber.org/jabber.org: this is for tony, the guy that hacked 
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kingcope ^_ 
(4:57:54PM) yohoho@jabber.cec.de: I owned the ftakout of somcj^omains, sorne^Jj 

domains, and ltnay have insane leads on dozens of^Bboxes 
(4:57:57 PM) yohoho@jabber.ccc.de: thousands of^BJomains 

(4:58^0^M) yohoho@jabber.ccc.de: I am already talking to someone fromB Bwho runs 
#op| 

(4:58:14 PM) ieondavidson@jabber.org/jabber.org: awesome 

(5:02:23 PM) yohoho@jabber.ccc.de: yes I will try to make preparations for thursday night 

(5:02:26 PM) yohoho@jabbenccc.de: maybe gyjfr as hell friday morning 

(5:02:28 PM) yohoho@jabber.ccc.de: on this | | target 

(5:02:29 PM) yohoho@jabber.ccc.de: ok? 

(5:03:40 PM) leo»davidson@jahher.org/jabher.org: ja 

(5:05:32 PM) Ieoudayids«H@jabber.org/jabber.0rg; any word on those^|targets? 

(5:05:59 PM) yohoho@jabber.ccc.de: give me 10 

(5:06:03 PM) yohoho@jabber.ccc.de: eating 

(5:06:16 pm) leondavids©n@jabber.org/jabbcr.ot*g: ja for sure 

(5:06:18 PM.) ieondavidsQ»@jabber.org/jabber,org: lalkign to tony 

(5:06:20 PM) Ieondavid8on@jabber.org/jabber.org: I love this nigga 

(5:06:37 PM) leondavidson@jabbei\org/jabber.org: he has a spy within kingcope's circle 

(5:06:44 PM) leondavidson@jabber.org/jabber,org: and kcope was bragging he spoke to me this 

morning 

(5:06:54 PM) IeoMavidsott@jabhGr.org/jabber.org: so tony's like, dont ttrust him. just feck him 

(5:07:05 PM) leo«davidson@jabber.org/jabher.org: (I think tonys going to ownB 

again) ^^^^^^^^ 

(5:07:05 PM) Ieondavid5oa@jabber«org/jabber.org; haha 

(5:07:21 PM) Ieoi*davidson@jabber.org/jabber.org: anyway enjoy your food, hit me up when 
you're done 

(5:15:56 PM) yohoho@jabber.ccc.de: ok back 

(5:15:59 PM) yohoho@jabber.ccc.de: also talking to value 

(5:!6:05 PM) yohoho@jabber.ccc.de: about maybe ddosin' some sites on friday as well 
(5:16:09 PM) yohoho@jabber.ccc.de: so we have deface and ddos line dup 
(5:1.6:17 PM) !eondavidson@j abber.org/jab ber.org: yup 

(5:16:27 PM) leondavidson@jabber.org/jabber,org: his net is growing, he has some new 
malware spreading here and there 

(5:16:46 PM) yohoho@jabber.ccc.de: he is really interested ir^Htargets 

(5:16:49 PM) yohoho@jabber.ccc.de; but I dont 1 know what totell him 

(5:16:54 PM) yohoho@jabber.ccc.de: it's not my call, I can't give him anything 

(5:17:34 PM) lc<ttis^v^^f^^Mj^}rg!lo.bb^r.org: yeah hereon asking me for it etc. I said 1 

try wha t 1 can doB I- | |ias ties to I Bete, he wants to help the sauce 

against etc 

(5:17:42 PM) leoRdavidson@jabber.org/jabber.org: niggas be passionate about all this ish 
(5:18:12 PM) leondavidson@jabber.org/jabber.org: setting a new box to serve as another tor 
onion for us as a third backup 

(5:18:18 PM) 3eostdavidson@jabber.org/jabber.org: ill give you details soon 

(5:18:28 PM) 1exmdavidson@jabber.org/jahber.org: I want us to have redundant backups for all 
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our shit 

(5:18:33 PM) yohoho@jabber.ccc.de: 1 agree 

(5:19:15 PM) leondavidson@jabber^ since niggas is slacking on siicd/privatc 

ircd. I talked to my people @B wid they'd giving me an unlabeled box for privS ircd 

(5:23:55 PM) leondavidson@jabiM?!^ btw you hear whats happening tonight? 

(5:24:11 PM) yohoho@jabber.ccc.de: hmm? 

(5:24:20 PM) leondavidsoiK$jabber.org/jabber.org: cabin crew is getting killed 

(5:24:50 PM) leondavidsoR@jabber.org/Jabber.org: keep it between us 

(5:25:05 PM) leondavids0n@jabber.org/jabbcr.org: but jackals on a rampage, hes taking over 

their twitters and killing the crew 

(5:25:11 PM) leondavid$0u@jabber.Qrg/jabbes\org: because of all the media whoring 
(5:25:14 PM) leoudavidsoH@jabber,org/jabber.org: and (he drama 
(5:25:17 PM) yohoho@jabber.ccc.de: that is awesome 
(5:25:21 PM) leo«davids©fl@jabber.org/jabber.org: ja 
(5:25:25 PM) yohoho@jabber.ccc.de: ftick cabin 
(5:25:26 PM) yohoho@jabber.ccc.de: flick them harrl 
(5:25:34 PM) yohoho@jabber.ccc.de; especially |and| 
(5:26:26 PM) leondavidson@jabber.org/jabber.arg; I liked that they worked as a team (its no 
secret I like small teams, etc.. and its effectiveness) but them niggas is all ego-tripping lamers. 
(5:27:43 PM) yohoho@jabber.ccc.de: yes 

(5:28:00 PM) ieondavidson@jabber.org/jabber.org: let me know whats goodie with those 
when you get a minute so I can move on to next shit 

(5:28:04 PM) leoudavid$on@j abher.org/jahber.org: and whts good for friday? 
(5:28:25 PM) yohoho@jabber.ccc.de: going t<^^/n a few .govs loi. 
(5:28:34 PM) yolioho@jabber.ccc.de: just the^|box 
(5:2S:58 PM}lMndavidson@jabber.org/jahber.org: word up 
(5:29:18 PM) yohoho@jabber.ccc.de: we need something every friday 
(5:29:22 PM) yohoho@jabber.ccc.de: and plus 

(5:29:26 PM) yohoho@jabber.ccc.de: since this one^P>ox, probaly isnt' going to give us any 
additional leads 

(5:29:29 PM) yohoho@jabber.ccc.de: and no mail 
(5:29:32 PM) yohoho@jabber.ccc.de: may as well nuk e that mof o 
(5:29:35 PM) yohoho@jabber.ccc.de: all the mail is onf" 
(5:29:58 PM) leoiadaYidso.r»@i abber.org/ j ab ber.org: jea 
(5:4 1 ;54 Prvi) leondavidson@ja bber,org/jabber.orgj 

BH>ig target, they made a massive power move, they sent letters to 
48 states (probably excluding alaska and hawaii) basically saying, give us 225million per prison 
and we'll manage all your prisoners 

(5:42:49 PM) Ieoiidavidson@jabber.org/jabber.org: 10800000000 - 225*48 a year 

(5:43:09 PM) yohoho@jabber.ccc.de: oh I know 

(5:43:12 PM) yohoho@jabber.ccc.de: that is biggest target ever. 

(5:43:16 PM) yohoho@jabber.ccc.de: they run plesk, in fact. 

(5:43:18 PM) yohoho@jabber.ccc.de: but not vuln =( 

(5:43:22 PM) leondavidson@jahber.org/jabber.org: fuck! !!!!!!!! t! !!!!!!!!!!!!!!!!!! ! 1 
(5:43:24 PM) yohoho@jabber.ccc.de: maybe I will search for other subdomains though 
(5:43:26 PM) yohoho@jabber.ccc.de: did you ehar though? 



67595 



Case 1:1 2-cr-00185-LAP Document 69-1 Filed 04/16/14 Page 19 of 30 



(5:43:31 PM) yohoho@jabber.ccc.de: we have the2ncyargest private prisonc ompany 

(5:43:34 PM) yohoho@jabber.ccc.de: right afteij 

(5.43:38 PM) ICH)ndavidsott@jabber.0rg/jabber.org: no way 

(5:43:41 pm) ieondavidson@jabber.org/jabber.Qrg: sweet 

(5:43:45 PM) yohoho@jabber.ccc.de: yep. but (here's not too uch on it -( 

(5:43:48 PM) yohoho@jabber.ccc.de: it's on a bigass vhost 

(5:43:54 PM) yohoho@jabber.ccc.de: windows target 

(5:43:56 PM) yohoho@jabber.ccc.de: 1 put alex on it 

(5:43:59 PM) leondavidson@jabber.org/jabb?r.org: sounds good 

(5:44:09 PM) yohoho@jabber.ccc.de: we have bigger targets though 

(5:44: 1 5 PM) yohoho@jabber.ccc.de: jail management software developers 

(5:44:29 PM) yohoho@jabber.ccc.de: my ultimate goal is to start adding funds on prisoner 

commisary accounts, changing outdates etc 

(5:45:13 PM) Ieondavidson@jabber.org/jabbei\org; I'm 100% on commisary 

(5:45:34 PM) !eorcdavidson@jabber.or&'jabber.org: there's companies likejpay.com that allow 

you to send money to prisoners across the u.s. through their electronic system 

(5:45:46 PM) leondavidson@jabber.org/jabbei\org: even giving each prisoner a few dollars to 

eat changes their lives 

(5:45:4? PM) yohoho@jabber.ccc.de: hmm interesting 

(5:45:51 PM) lcondavidson@jabbcr,org/jabbcr.org: and we'll send them a massive message 

(5:45:54 PM) IeondavidsoB@jabber.Grg/jabber.org: to all prisoners 

(5:45:58 PM) leo»davidson@j abbcr.org/jabber.org: that anonymous supports them 

(5:45:59 PM) leoi*davidson@jabi>er.org/jabber.org: etc 

(5:46:09 PM) yohoho@jabber.ccc.de: I agree that's what we need to do 

(5:4C>:49 PM) leoadavidson@jabber.org/jabber.org: you know how many prisoners are in there. 

no families, no loved ones. FUCKING BROKE, eating state pbj sandwiches that taste like shit 

because they simply have no way to buy any food or rallies to smoke 

(5:46:53 PM) leondavidson@]abber.org/jabber.org; niggas gotta be in there suffering 

(5:46:56 PM.) Ieondavidson@jabber»org/jabber.org: its a fucking slave camp 

(5:47:05 PM) ieond&vidson@jabber.f>rg/jabber*org: having these prisoners work 14 hour shifts 

for 20 cents an hour 

(5:47:25 PM) yohoho@jabber.ccc.de: yes it is ridiculous 
(5:47:32 PM) yohoho@jabber.ccc.de: especially with immigrants 

(5:47:46 PM) yohoho@jabber.ccc.de: they say they are illegal, but they lock them up and pay 
them welll below minimum wage 

(5:47:57 PM) yohoho@jabber,ccc,de: in their prison sweatshops 

(5:51:22 PM) leoadavidson@j abber.org/jabber.org; http://www.theonion.com/articles/iran- 
worried-us-might--be-building-8500th-nuclear"W,27325/ tho meant as a joke is actually pretty sad 
state of reality 

(6:46:52 PM) Ieoadavid5©n@jabber.org/jabbeF,org; rofl 

(6:46:58 PM) leosdavidson@jabber.org/jabber.org: these niggas are wild 

(6:47:00 PM) ieondavidson@jabber.org/jabber.org:| 

(6:47:13 PM) ]eondavidson@jabber.org/jabber.org: using das amplification attacks to shut 
down the root dns servers 

(6:48:40 PM) yohoho@jabber.ccc.de: yes if oyu hit root dns servers shit will go wild 
(6:48:45 PM) yohoho@jabber.ccc.de: maybe more people will use services like opendns 
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(6:53:21 PM) yohoho@jabber.ccc.de: ok 

(6:53.25 PM) yohoho@ jabber.ccc.de: going to hit ihosc^for oyu now 

(6:53:35 PM) leoiidavidson@jabber.org/jabber.org; kk 
(6:59:4j PM) le0ndavidson@jabber.org/jabber.org: 

http://exploitehop.wordpr&$s.cot^^ 
coutd-allow-remote-code-cxecution/ 

(7:01:40 PM) yohoho@jabber.ccc.de: yo I just owned another major target 
(7:01:40 PM) yohoho@jabber.ccc.de: dumping via sqlmap now 
(7:01:40 PM) yohoho@fabber.ccc.de: this will be delicious 
(7:01:57 PM) leondavidson@jabber.0rg/jabber,org; aRF 
(7:02:07 PM) leondavidsou@jabber.org/jabber.org; prison shiz?? 
(7:03:34 PM) yohoho@jabber.ccc.de: nah 
(7:03:34 PM) yohoho@jabber.ccc.de: well 

(7:03:39 PM) yohoho@jabber.ccc.de: I already have a lot of prison shit lined up 
(7:03:41 PM) yohoho@jabber.ccc.de: neecnielr^ictually 
(7:03:47 PM) yohoho@jabber.ccc.de: | | rooted 

(7:03:52 PM) yohoho@jabber.ccc.de: I uploadd mails to our .onion 
(7:03:56 PM) yohoho@jabber.ccc.de: elche has been gong through it 

(?:05:ll PM) leondavidson@jabber.org/jabber,org: faggot ass tor and my vpn dont like each 
other but good shit looking it over 

(7:05:55 PM) leondav*dso*i@jabber.org/jabber.org: prison systems software? 
(7:06:12 PM) yohoho@jabber.ccc.de: yes 

(7:06:16 PM) yohoho@jabber.ccc.de: the maii contains lots of info 

(7:06:27 PM) yohoho@jabber.ccc.de: I just dont ahve time to follow up on it 

(7:06:30 PM) yohoho@jabber.ccc.de: which is why we need help 

(7:06:31 PM) lcondavidsors@jabber.org/jabbenorg: piz tell me we have access to soutrce codes 

(7:06:44 PM) yohoho@jabber.ccc.de: I barely looked through it 

(7:06:52 PM) yohoho@jabber.ccc.de: we need you to get your hands dirty 

(7:09:09 PM) leoBdav1dson@jabber.org/jabber,org: so get me datas nigga 

(7:09:20 PM) leonclavldsoii@jabber.org/jabben^ 

(7:10:36 PM) yohoho@jabber.ccc.de: httpsj 

(7:10:43 PM) yohoho@jabber.ccc.de: and I already dumped mail and rendered it 
(7:10:44 PM) yohoho@jabber.ccc.de: 1 mm 
(7:11:11 PM) leQndavidson@jabber.org/iah ber.or g: kk 
(7:27:03 PM) yohoho@jabber.ccc.dc: https:/| 
www| 

(7:27:05 PM) yohoho@jabher.ccc.de: those are all rooted 

(7:27:10 PM) yohoho@jabber.ccc.de: none of the^thersworked 

(7:27:29 PM) yohoho@jabber.ccc.de: now on | |is not on there, but there is 

ctrl.php3, which accepts a POST parameter of x to run commands 

(7:27:39 PM) yohoho@jabber,ccc.dc: die other two both have core.php 

(7:27:57 PM) yohoho@jabber.ccc.de: they all look like they have hundreds of domains and mails 
(7:28:01 PM) yohoho@jabber.ccc.de: hopefully they wil put it to good use 
(7:28:08 PM) yohoho@jabber.ccc.de: and hopefulyl were getitngs omething out of all this 
(7:29:04 PM) leofldavidson@jabber.org/jabber.org: trust me negro everything i do serves a 
purpose ;P 
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(7:43:48 PM) yohoho@jabber.ccc.de: shadow_dxs 

(7:43:53 PM) yohoho@jabber.ccc.de: he is known snitch right? 

(7:44:27 PM) leondavidsoit@jabber.org/jabber,org; not really hes a troll mainly, iikes to fuck 
with people from both sides 

(7:44:31 PM) ieondavidson@jabber.org/jabber.org: old carder 
(7:44:39 PM) Icottdavidson@jabber.org/j»Mer.org: font fixed. 
(7:44:52 PM) yohoho@jabbenccc.de; lol 

(7:45:10 PM) yohoho@jabber.ccc.de; check privShaha fori I mails 
(7:45:14 PM) yohoho@jabber.ccc.de: needs work 

(7:45:16 PM) lGOiidavid$on@jabher.org/jabber,org: trolls anons and prosec ppl. e.g. he recently 

doxed awinees girlfriend and posted her pics 

(7:45:19 PM)leondavidsoii@jabber.org/jabber.org: kk looking 

(7:45:32 PM) yohoho@jabber.ccc.de: he wasn't brlcksqu4d ? 

(7:45:42 PM) yohoho@jabber.ccc.de: and why have I heard nothing but rumors about him being 
a snitch 

(7:46:37 PM) Ieondavidsoo@jabber.org/jabber.org: no he wasnt and youve probably heard it 
because he hangs with prosec ppl 

(7:47:01 PM) Ieondavidson@jabber.org/jabber.org: 2600 and now reapersec etc 

(7:47:32 PM) Ieondavidson@jabber.org/jabber.org: i get good laughs from him watching him 

troll his own ppl 

(7:53:25 PM) yohoho@jabber.ccc.de: ok yo 

(7:53:28 PM) yolioho@jabber.ccc.de; got shell on this high profile target 

(7:53:29 PM) yohoho@jabber.cec.de: LULZ 

(7:54:28 PM) teondavidson@j abber.org/jabber.org: ARF 

(7:54:32 PM) Ieortdavids0n@jabber.org/jabber.org: good shit 

(7:55:24 PM) leondavids0fl@jabber.0rg/jabber.oi'g: goin throughUmails 

(7:55:31 PM) yohoho@jabber.ccc.de: billing is the major one 

(7:55:32 PM) yohoho@jabber.ccc.de: and also talk to elche 

(7:55:35 PM) yohoho@jabber.ccc.de: because he already looked through em 

(7:55:43 PM) yohoho@jabber.ccc.de: basically you can see references to 'ftp conneciton' etc 

(7:57:40 PM) Ieondavid$on@jabber.org/jabber.org: kk 

(8: 1 1 :23 PM) yohoho@jabber.ccc.de: Yo I think this i smajor target. 

(8:1 3:27 PM) yohobo@jabber.ccc.de: Our engineers worked closely with one of the UK's largest 
police forces to help develop what is undoubtedly one of the most sophisticated Command and 
Control systems in the world. 

(S: 11:43 PM) leondavidson@jabbiT.org/jabber.org: o wow 
(8:1 1:47 PM) leond«vidsoia@jabber.org/jabber.org; thats nice 
(8:11:50 PM) leondavidson@jabber.org/jafober.org: got mails? 
(8:11 :52 PM) yohoho@jabber.ccc.de: and that's not all either 
(8:11:55 PM) yoholio@jabber.ccc.de: yes I think so 
(8:11:58 PM) yohoho@jabber.ccc.de: at least some mail 

(8: 12:05 PM) yohoho@jabbcr.ccc.de: not sure if it is the main mail server for the entire company 

(8:12:58 PM) leondavidson@jabher.org/jabher.org: mhm 

(8:15:14 PM) yohoho@jabber.ccc.de: and 

(8:15:17 PM) yohoho@jabber.ccc.de: this guy just ownedB 
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(8:15:18 PM) leondavids«m@jabber.Grg/jabber.org; hows user clb? MI of uk feds? 
(8:15:29 PM) yohoho@jabber.ccc.de: unfortunately the DB I have so far isn't much 
(8:15:34 PM) yohoho@jabber,ccc.de: just the admin logins to this one site 
(8:15:41 PM) yohoho@iabber.ccc.de: barely begun digging into the box 
(8:15:46 PM) yohoho@j abber.ccc.de: fuck homey 

(8:35:52 PM) yohoho@jabber.ccc.de: not to mention we gotta wrap up thib^box 

(8:15:53 PM) yohoho@jabber.ccc.de: and ^^^^^ 

(8:15:58 PM) yohoho@jabber.ccc.de: helping this guy get on( ^^^^^ 

(8:16:03 PM) 1 eon davidson@j abb er.org/ jabber.org: the guy who owncd( |i that just kid? 

(8:16:05 PM) yohoho@jabber.ccc.de: it's too much 

(8:16:09 PM) yohoho@jabbcr.ccc.de: canc3r 

(8:16:13 PM) yohoho@jabber.ccc.de: just hit me up too thogh 

(8:16:24 PM) yohoho@jabber.ccc.de: not sure if he is legit he says sql injection 

(8:16:28 PM) yohoho@jabber.ccc.de: bout a european gov site 

(8:16:45 PM) Ieondavidson@jabber.org/jabber.org: hes been telling me shit but i thought he 
was fed 

(8:16:52 PM) ieondavidson@jabber.org/jabber.org: cause he namedropped me 
(8:16:54 PM) yohoho@jabber.ccc.de: yeah I got suspicious too 
(8:16:55 PM) yohoho@jabber.ccc.de: about just 

(8:17:09 PM) yohoho@jabber.ccc.de: he started asking what team I was, and how many ppl were 
in atnisec, and whether we got that FBI phonecall 
(8:17:10 PM) yohoho@jabber.ccc.de: lot 

(8:26:54 pm) Ieottdavid$on@jahber.org/Jabher.org: yeh. fed to me honestly 
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#anti sec redhack . 1 og 
— Log opened wed Jan 25 21:54:12 2012 

21:54 -!- Sabu [sabu@security.anonymo.us] has joined #anti secRedHack 

21:54 irssi: #anti secRedHack: Total of 1 nicks [1 ops, 0 halfops, 0 voices, 0 

normal] 

21:54 -!- irssi: Join to #anti secRedHack was synced in 2 sees 
21:54 mode/#anti secRedHack [+s] by Sabu 
22:03 lsabit.cryto.net sabu invited Redstar into the channel. 
22:03 ! kerpia.cryto.net Sabu invited sup_g into the channel. 

22:05 -I- sup_g Ighost@5lBC5033.870c7BEl.49E80F3.iP] has joined #anti secRedHack 
22:05 Redstar [cHiEf@B0266B94.7Fl3FC28.9AEC544A.XP] has joined 
#anti secRedHack 

22:05 < Redstar> re ray brothers 
22:05 <@Sabu> hey :) 
22:05 < Redstar> .] 

22:05 <@Sabu> Redstar: meet my brother sup_g 

22:05 <@sabu> sup_g: meet my good friend Reastar 

22:05 < sup„g> sup redstar, big fan 

22:05 < sup_g> as an anarchist communist 

22:06 < sup_g> owning some shit for you =) 

22:06 < RedStar> sup hello my brother, nice t m u ;) 

22:06 <@Sabu^^|^)een a long time man. 1 was worried about you. I read lots of 
arrests in| |: : 
22:06 <@Sabu> your team ok? 

22:06 < Redstar> sutjer^^founf^ne bug police of state 
22:06 < RedStaQ 




targets as well. I'll send you shortly 




sup_g> A rooted ror you 
22:07 < sup__g> more coming 
22:07 <@Sabu> ;) 
22:07 <@Sabu> sup_g: I got more 

22:08 < sup„g> k " 

22:08 <@sabu> redstar: we rooted these for you - have your team get into the 
boxes and do what you do ;) 

22:08 < Redstar> super sup, thanks thank on behalf of my people my brothe 
22:08 < sup_g>_D 

22:08 < sup„g> 

22:08 < sup„g> is tnat enougn ror ya 
22:09 < Redstar> no sql injection 

22:09 <@Sabu> no its already shelle d for yo u and rooted 

Hbut i an found "admin panel" 



22:09 < Redstar> its very important| 
22:09 < Redstar> i found user pass 
22:10 < Redstar> aha 
22:10 < RedStar> i understand, but how many sites is server? 
22:10 < sup_g> haven't even looked 

22:10 < sup_g> sorry I will be busy for about 25 minutes, you will still be here? 

22:11 < RedStar> yes yes 

22:11 < Redstar> Make yourself at home 

22:11 < RedStar> i am very bad english sory ;) 

22:12 < sup_g> that's ok =0 

22:12 < RedStar> google rulez ;) 

22:12 < sup_g> we are on the same team 

22:12 < Redstar> ok i waiting 

22:13 <@Sabu> ;) ^^^^ 
22:13 <@sabu> Redstar: is your team OK? I read a lot of arrests in | |j was 

worried for you 

22:14 < RedStar> ok Sabu, I am glad, only 
end of preparation, a nice server rootlamafi 
22:15 < RedStar> yes sabu 
22:15 <@sabu> yestakevpur time 
22:15 < RedStar>B |i s n "*9 prison 
22:15 < Redstar> big. . 

22:16 < Redstar> evreday arests dissident 
22:16 <@Sabu> not good., hopefully with these 
impact 

22:16 < sup.,g> there* s a lot 
22:16 < sup_g> however 

22:16 < Redstar> We stopped because of a little away from him. benefits, but do 

Page 1 



jive me the time of the week until the 
ok? 



Iroots you can make big 
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not fear death;) 

22:16 < sup__g> you need to make sure you dump email and mysc 
22:27 <@Sabu> if I am not around /msgsup„g he is my trustee 
communicate with him directly and he is fellow anarchist :) 
22:17 < sup„g> and mirror them online 
22:17 < sup__g> so you can embarass them most 
22:17 < sup_g> ) 
22:17 < sup__g> ;) 



1 databases 
friend, you 



can 




< sup_g> ao you ai i nave some 
mail spools and databases? 
22:18 < RedStar> sup_g brother Look at You. We could not find admin panel. This 

?oint is very important 
2:18 < sup_g> have you ran that vulnerability through sqtmap or hajiv? 
22:19 < RedStar> yes 




22:19 < RedStar> Database 
22:19 < RedStar> Table : members 




19 < Redstar> 



< Red5tar> 




22:19 
22:20 
thei r 
22:20 
22:21 
22:21 
22:21 
22:21 
22:21 
22:21 
22:21 
22:21 
22:21 
22:21 
22:21 
22:21 



< Redstar> yes hajiv its runned this server 

< sup„g> nice have you tried cracking those hashes and checking against 
email accounts? 

< sup_g> lol ©gmail 

< Redstar> i am download all information scree 

< RedStar> +t 

< sup_g> soj; 

< RedStar> 

< Redstar> 

< RedStar> 

< Redstar> 

< Redstar> 

< Redstar> 

< Redstar> 

< Redstar> 

< RedStar> 





22:23 < Redstar> Table 
22:23 < Redstar> username: password: 

22:23 < Redstar> 

22:24 <@Sabu> nice let me see it I can tmd admin 

page 2 
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Redstar> i am found all screet information but i am not founded admin cp 



let's public information? 
save it until we find admin panel 



22:28 

22:29 < RedStar> frustrating, if you ca n not 
22:30 < Redstar> sabu brother look this 
22:30 <@Sabu> RedStar: no public information 
22:30 <@Sabu> ok 
22:32 < Redstar> ok ;) 

22:35 <@Sabu> RedStar: stay here ok ? I'll be back in a few minutes 
22:35 < sup_g> back 

22:36 < sup„g> yes redstar you should hold onto that until we can find osmething 
to do with those passwords 

22:36 < sup__g> maybe if you login to their emails it will contain ftp info to 
that domain 

22:37 < sup_g> ok rooting more of these targets for you 

22:39 < Redstar> super brother, this ire server is now always open in the 

meantime? 

sup_g> 
sup„g> LOL« 
sup_g> yes. 
Redstar> vauv ;) 
Red5tar> 700 super 
sup„g> 1 min. 
sup.„g> another box 
sup_g> 
Redstar> 

sup_g> you need to make sure you dump the mail 
sup_g> that is importan^^^^^^^^^^^^ 

sup_g> it is all in| (on 

Redstar> qmail :) 
RedStar> you make reverse? 

comparison named. conf etc? 
can send you a reverse shell 
ah oky 

kernel or this server 



22:40 
22:40 
22:40 
22:40 
22:41 
22:41 
22:42 
22:42 
22:42 
22:42 
22:42 
22:42 
22:43 
22:44 
22:44 
22:44 
22:44 
22:45 
22:49 
22:49 
22:49 
22:49 
22:50 
22:50 
22: SO 
22:51 
22:51 
22:51 
22:51 
22:51 
22:51 
22:52 
22:52 
22:52 
22:52 
22:52 
22:52 
22:57 
22:57 
22:57 
22:58 
22:58 
22:58 
22:58 
22:58 
22:58 
22:58 
23:18 
23:19 



how many gov ? 
83 



rooti n 




safe mode off? 



all be .govs 

not matter, I think goes to talk instead of ;) 

m rooted 
rooted 
rooted 
rooted 



Redstao 
sup_g> I 
Redstar> 
RedStar> 
sup_g> 
sup„g> 

sup_g> LOtOL 
Redstar> no ;)) 
sup_g> they may not 
sup_g> obviously 
RedStar> yes does 
sup_g 
sup_g 
sup_g 
sup_g 
sup_g 
sup_g 
sup_g> 
sup„g> 
5up_g> 

sup„g> _ _ _ 
sup_g> out xney are wmaows 
sup„g> I can get you ftp passwords for all accounts tho 
sup_g> u there? 
Redstar> oh ftp account super 
Redstar> i am here i find admin panel 
sup_g> on that police one? 
sup„g> upload backdoor. asp =0 
RedStar> yes 
sup_g> err .php 
Redstar > You see a break. 
sup_g> 

Redstar 

'ose boxes 





<@sabu> 

< Redstar> big job brothers 
23:19 < sup_g> yeah it's pretty crazy 
23:20 < Redstar> when the index to throw, and what 
23:23 < Redstar> There are many denunciation mail;) 
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lload via thunderbi rd over tor 
23:24 < su'p_g> then render with mhonarc 
23; 24 < sup_g> do you ahve a server that^^^u store/mirror/deploy their mail 
23:28 < RedStar> yes this mail police oij ^denunciation mail- cache 
information 



23:34 
23:34 
23:34 
23:34 
23:35 
amounts 
23:37 < 
23:38 < 
23:38 < 
23:40 < 
23:40 < 
23:40 < 
23:40 
23:40 
23:40 
23:40 
23:40 
23:40 
23:40 



star d 



sup_g> omfg, so 
sup_g> Is -al i 
sup_g> 
sup__g> 616 
sup_g> reds' 
of mail from? 
Redstar> bounce 
sup_g> hacked server 
sup_g> someplace you can 
RedStar> 
Redstar> 
Redstar> 
Redstar> 
RedStar> 
Redstar> 
Redstar> 
Redstar> 
Redstar> 
Redstar> 



II wc 

5544 43813 
omains have mail stored here 
"do you have a bounce box that you can safely wget large 

box? 





23:40 


< 


Redstar> 


23:40 


< 


Redstar> 


23:40 


< 


Redstar> 


23:40 


< 


RedStar> 


23:40 


< 


Redstar> 





< 
< 


Reastar> 


23:40 


< 


Redstar> 


23:40 


< 


Redstar> 


23:40 


< 


RedStar> 


23:40 


< 


Redstar> 


23:40 


< 


RedStar> 


23:40 


< 


Redstar> 


23:40 


<: 


Redstar> 


23:41 


< 


RedStar> 


23:41 


< 


Redstar> 


23:41 


< 


RedStar> 


23:41 


< 


Redstar> 


23:41 


< 


Redstar> 


23:41 


< 


Redstar> 


23:41 


< 


RedStar> 


23:41 


< 


RedStar> 


23:41 


< 


RedStar> 


23:41 


< 


Redstar> 



23 


41 


< 


RedStar> 


23 


41 


< 


Redstar> 


23 


41 


< 


Redstar> 


23 


41 


< 


Redstar> 


23 


41 


< 


Redsta^ 


23:41 


< 


Redstar> 
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23:41 < Redstar> 
23:41 < RedStao 
23:41 < Redstar> 
23:41 < RedStar> 
23:41 < Redstar> 




m 



eel 

23:49 
23:49 
23:52 
23:55 
23:55 
23:58 
23:58 



sup_g> that's good 

sup_g> I am working on these other ^^Htho 

Redstar> okay sup i am here comrad^^^ 

sup„g> ok I will have a shell for you very soon 

RedSta r> ok brother ;) 

sup„g> then do this: 




4,3: ;>y < 
— Day 


00:00 


< 


00:03 


< 


00:05 


< 


00:05 


< 


00:05 


< 


00:05 


< 


00:05 


< 


00:05 


< 


00:05 


< 


00:05 


< 


00:05 


< 


00:05 


< 


00:06 


< 


00:06 


< 


00:06 


< 


00:07 


< 


00:07 


< 


00:07 


< 


00:07 


< 


00:08 


< 


00:08 


< 


00:09 


< 


00:13 


< 



sup_g> there are DOZENS of mail for 
sup_g> you got it? 
RedStar> yeps 
RedStar>| 
Red5tar>l 
RedStar>| 




or some crazy shit 




RedStar>| 
Redstar>| 
Redstar>| 

sup„_g> also 

sup„g> make sure you wipe that shit when we rm 
sup_g> bi^^^n^^^jr^Qr^t^i s getting mail 
sup_q> ■ 

sup_g> damn that s a lot of mai 
Redstar> 26^^^m super 
sup_g> i'll copy it 
Redstar> nice job comrade 
RedStar> okay. 

sup„g> I am makina "all" mail and "justgov" mail 
SUp_g> Cause "all Will nrnhahlv hp > 100GB 
Redstar " ~~ 
sup_g>[ 
<- 550MB 

00:13 < sup_g> downloading and verifying 
00:14 < Redstao my internet very very 
day ; ( shi tnet . . 
00:14 < sup_g> you using proxy? 

" ' < sup_g> (I can ^njjoas though) 

< sup_g> ok that| |is 9°°d 
00:15 < sup._g> real good =■) 
00:19 < RedStar> yes and my ISP is shit 

< Redstar> you download? 

< Redstar> i say my comrade, is redhack member, he is download. 

< sup_g> ok 

< sup_g> are you all able to upload that mail somewhere? 
00:20 < sup_g> and release it as torrent 
00:20 < sup_g> and yes 1 did download and verify 

< Redstar> ok 

< Redstar> 

< Redstar> | 

< sup_g> it was owned already? 

< sup_g> lol . 

< sup_g> well now you have the mail 

< sup_g> that might have the dirt, the controversy, the secrets 

< Redstar> ok 

< RedStar> he is download its time 

Page 5 



00:14 
00:15 



00:19 
00:19 
00:19 
00:20 



00:21 
00:21 
00:22 
00:22 
00:22 
00:23 
00:23 
00:24 
00:28 



Past or i am downloading its file min 1 
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00:30 


< 


sup. 


-g> 


00:30 


< 


sup. 


-g> 


00:32 


< 


sup. 




00:32 


< 


sup_ 


-g> 


00:32 


< 


sup_ 






00:32 
00:32 
00:32 
00:33 
00:33 
00:33 
00:34 
00:35 
00:36 
00:37 
00:37 
00:38 
00:38 
00:38 
00:39 
00:40 
00:40 



sup_g> drwxr-xr-x 13 root 
sup_g> drwxr-xr-x 13 root 
sup_g> drwxr-xr-x 13 root 
sup_g> drwxr-xr-x 13 root 
RedStar> nice its time how 
sup_g> hundreds again 
Red5tar> :) 

Redstar> man is real worker 
sup_g> working class =) 
<@sabu> ;) 
< sup_g> ok 
sup_g> 



16 12:08 
Dec 16 12:08 
Dec 16 12:08 

Dec 16 12:08 
Dec 16 12:08 

12:08 
12:08 
12:08 
12:08 




omai n 



;) 



htt 

5up_g>" 

sup_g> 
sup„g> 
Redsta 
sup„g> 
RedStar> 




idiot ha? 



root 



-y--- 20 root 




popuser 
popuser 



popuser popuser 
root popuser 
popuser popuser 



uu:4U < sup_g> arwxr-x — 
00:40 < sup„g> drwxr-x — 
cr-x — 




2 root 
2 root 
6 root 

2 root 



popuser 
popuser 
popuser 

popuser 



:4 
00:41 
00:41 
00:41 
00:41 
00:42 



lApr 13 2011 
Inov 14 11:26 
loec 16 12:13 

\mr 30 2011 

loec 16 12:13 

\mr 30 2013 
har 30 2013 
bar 30 2011" 

|Apr 25 2011 

I Dec 16 12:13| 



141032724 Jan 25 19:52 



p~g> drwx 3 popuser popuser 

sup_g> ~ 40 government mail spools -) 
RedStar> 654 total 
RedStar> :) 

sup_g> they will FREAK 
sup_q> -rw-r --r-- 1 root root 

only 140MB 
sup_g> stTTT something though 
00:43 <@Sabu> a lot of great taraets 

00:44 < Redstar> safau brother, where did you get this defacer, man of genius:)) 
00:45 <@sabu> he is my very good friend :) you might have to borrow him for your 
team haha 

00:45 < RedStar> ;))) 

00:45 < sup_g> <- dirty red =) 

00:45 < sup_g> black and red 

00:45 < RedStar> plus he is anachist communist ;) perfect man :) 
00:45 <@Sabu> ;D 

00:47 < sup_g> hopefully the mail will have a lot of dirty secrets on the 
government 

00:47 < sup_g> also before you deface 
00:47 < RedStar> Sabu; is generated young fans 
http: //www. youtube . com/watch?v-705ex5zU0m4 
00:47 < sup_g> 
00:47 < sup_g>| 
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00:48 
00:48 
00:49 
00:49 
00:49 
O 

00:49 

00:49 

00:50 

00:50 

00:50 

00:52 

ddos 

00:52 

00:53 

00:53 

00:53 

00:53 

00:53 



< sup_g> and also 

< sup„g> shred 

< sup„g> also see all databases. sql 

< sup_g> download that shit 

<f?.sabu> very nice intro. you should throw our group name in it.. #antisec 



that for the defacements? 
Sup: 




<@Sabu> is 

< RedStar> 

< sup_g> 

< sup_g> 

< sup_g> 

< Redstar> yes and one supris, we make one group is name "others".. For the 
and real miting.. its time many people get to know 

< RedStar> real protest and meeting 

< sup_g> another 

< sup__g> Is -a! /var/www/vhosts 

15 root root 
14 root root 
14 root root 

root root 

root root 



< sup_g> drwxr-xr-x 

< sup„g> drwxr-xr-x 

< sup__g> drwxr-xr-x 



54 

00:54 
00:54 
00:54 
00:54 
00:54 




< 


5UP_ 


-9> 


< 


sup_ 


-S> 


< 


sup. 


-9> 


< 


sup_ 


-9> 


< 


sup_ 


-9> 


< 


sup_ 





00:54 
00:54 
00:54 
00:55 
01:00 



irwxr-xr-x id root rooi 
irwxr-xr-x 13 root rooi 
irwxr-xr-x 14 root rooi 
jood? 

< sup_§> is -al /var/qmai 1 /mail names I 

6 popuser popuser 
12 popuser popuser 

2 popuser popuser 

opuser popuser 

popuser popuser 

popuser popuser 
11 popuser popuser 
2 popuser popuser 



3un 


16 


2011 


Sep 


9 


2010 


Sep 


9 


2010 


Sep 


9 


2010 


Sep 


9 


2010 


Feb 


27 


2010 


Feb 


27 


2010 


Dun 


25 


2010 





sup_g> drwx 

sup_g> drwx 

sup_g> rnoar mail 
Redsta 
sup_q> 




2011 
2010 

2010 

2010 

2010 



May 14 2010 
Jan 16 16:04 
3un 25 2010 






01:01 
01:01 
01:04 
01:04 
01:04 
01:04 
01:07 
01:07 
01:07 
01:07 
01:08 
01:08 
01:09 
01:09 
01:09 
01:09 
01:10 
01:13 
01:16 
01 : 17 
01:17 
01:17 
01:18 
europ 



Redstar> 
RedStar> 
sup_g> lol . 
sup_g> getting more 
Redstar> :) 

sup„g> already dumped their mail; 
sup_g> drwxr-xr-x 14 root root 
sup„g> drwxr-xr-x 
sup_g> drwxr-xr-x 
sup_g> g ood one s? 
RedStar> 
Redstar> 

sup„g> which one was that? 
su|J_g> did we get that one 
bad is not open ; ' 
national party of 



< 
< 
< 
< 
< 
< 
< 
< 
< 
< 
< 
< 
< 
< 

< RecJstar> 

< RedStar> 

< Redstar. 

< sup_g> 

< Redstar> 

< sup_g> n 

< RedStar> 



now 



14 root root 
14 root root 



-al 

Feb 8 
Mar 22 
Feb 8 



2009 
2010 
2009 




rci st party 





<@Sabu> good work ;) 
^^^^^^>u gentlemen realize this massive 

Page 7 



<- no mail thouc 
party :)| 



hack is going to make news in 
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01:18 <@Sabu> :X 

01:19 < sup_g> take your time redstar 

01:19 < sup_g> look at all their domains, all their files, databases, mail 

01:19 < sup_g> get it all up online for other people to read 

01:19 <@sabii> yeah 

01:19 < sup_g> then deface / rm 

01:19 < Redstar> needs is a good text for the index 
01:21 < sup_g> that's all I nave for now 

01:22 < sup_g> next time we will have some windows boxes for you 

01:22 < Redstar> sup brother when do we? other people need? you prepare the 

index? 

01:22 < sup_g> you don't want to read their mail first? 

01:22 <@Sabu> Redstar: look through the servers, find important mails 

01:23 <@sabu> you might find corruption evidence 

01:23 < sup_g> redstar when we own something we take time and find everything 
first 

01:23 < sup_g> I don't have time to look through all their files and mail? thats 
your job -) 

01:23 < Redstar> ok i say my comrade is look your mail zip 

01:25 <@sabu> while you guys read mails, you have time to prepare nice 

defacement, message, etc 

01:26 < Redstar> But I do not think anything will come to the emails, because 
these sites usually in small towns, villages, towns sites 
01:27 < sup„g> it still adds insult to injury =) 
01:27 < sup_g> throw gasoline on the flames _ 
01:28 < Redstar> its not importand sites., for example httpil 
is towns sites. . 
01:28 <@Sabu> yeah 

01:29 <@sabu> well my brother we leave it in your hands :) just tweet us when you 
do the hack to ©anonymousiRC and^anonvmousabu so we can spread your message 
01:29 <@sabu> I'll look for more ■ Btargets 

01:29 <@Sabu> better yet you fi ncTDTgHI targets let us know we'll try loookin 
at them 

01:29 < Redstar> ok brother 

01:32 < Redstar> for ex am pi M 1 user;B lpass| 

-> is police capital "HM|^B| 1,11 111 1 1 mail notice 

01:34 <@sabu> mhm 

01:34 < ftedstar> for example one found admin panel after we make index, is big 
job for | Bi finder user and pass but i am not find admin panel i am crazy 
days i anwio^Tound ; ( 
01:36. 




Ml 



Redstar> sql helper sup 
:37 < Redstar> one hacked this server is big job., andl 
li helper 2.7 



Isq'l bug 




01:39 
01:40 
01:40 
01:40 
01:41 
01:41 
01:42 
01:43 
01:43 
01:43 
01:44 
01:44 
01:44 
01:45 
01:46 
01:47 
01:47 
01:47 
01:48 



< Redstar> shit! . . went to a power i nope tnat as soon as tne 

< RedStar> sup deface incident when we do? tomorrow? weekend? 

< sup_g> weekend Im thinking 

< sup_g> take your time 

< sup._g> we have to at least upload all the mail 
<@Sabu> weekend is good 

< fiedstar> ok 

< Redstar> Saturday 20:00 this place, good? 
<@sahu> ja meet us here 
<@Sabu> we'll organizee 

< Redstar> because Now in the morning 03:53 
<@Sabu> ;) ok my brother good to see you 

< RedStar> friday or Saturday 20 or 21 or 22 is good.. ? 
<@Sabu> get rest ok? 

< RedStar> ok sabu, sup okey? and Do I need him for the index? 

< RedStao extra man.. 

< Redstar> you need an extra man in there? i speaking shit engnsh sory ;) 
<@5abu> haha 

<@Sabu> the index you can do make it nice ;) 
<@Sabu> we calk soon ok brother? going to sleep 

page 8 
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01:49 
01:50 
love 
01: 51 
01:51 
01:51 



Redstar> if you understood 
RedStar> I come here tomor 



ro^anc^v< 



ck. log 

I had done philosophy to you;) 

' ick 



RedStar> 
Redstao 



every day? you be here? 
alike. 



thick with 



09:06 
11:30 
11:31 
14:41 



in 34 sees 
has joined #anti secRedHack 

has quit [Client exited] 
has joined #antisecRedHack 
has quit [User quit: ] 



af te r all , we r re all 
ciao brothers 

!- Redstar [cHiEf@B0266s94-7Fl3FC28.9AEC544A.iP] has quit [user quit: 
hack the world] 

03:15 -!- sup_g [ghost@51BC5033.S70c7BEl.49E80F3.lP] has quit [User quit: 
Leavi ng] 

— log closed Mon Jan 30 03:12:05 2012 

— Log opened Mon 3 an 30 03:12:08 2012 

03:12 Sabu [monte@16lD78A9.6B94F3D, 5438D71B.IP] has joined #anti secRedHack 
03:12 -!- irssi: #antisecRedHack: Total of 1 nicks [1 ops, 0 halfops, 0 voices, 0 
normal] 

03:12 -!- irssi: Join to #anti secRedHack was synced 
09:06 -!- NeKa [NeKa@A9E8B38D « 178EA601 • 8A5989A9 . 1 P] 
< NeKa> heyy 

-!- NeKa [NeKa@A9E8B38D . 178EA601 . 8A5989A9 . I Pi 
-!- NeKa "NeKa@43F0F02E,F8849£5F.8A59B9A9.IP. 
-!- NeKa [NeKa@43F0F02E.F8849£5F,8A59B9A9,IP] 
23:30 -1- damn [damn@you. fucker] has joined #anti secRedHack 
23:30 -!- damn (damn@you. fucker] has left #antisecRedHack [Leaving] 

— Day changed Tue Jan 31 2012 

04:35 -!- XtmwX [sangue@kerpia-A28DD415.xd-dynami cctbcnetsupei) 
joined #anti secRedHack 

04:40 XtmwX [sangue@kerpia-A28DD415 .xd-dynami c.ctbcnetsuper . 
[User quit: Reserve your copy of -=[H2k Script]=- at: www.s2k.[ 
05:00 -I- XtmwX [sangue®kerpia-A28DD415.xd-dynamic.ctbcnetsuper| 
joined #antisecRedHack 

05:02 XtmwX [sangueQkerpi a-A28DD415. xd-dynami c.ctbcnetsuperj 
[user quit: Eu estava usando o -=[H2k Script]=- Pegue o seu em: 
05:03 -!- XtmwX [sangue$kerpia~A28DD415.xd-dynamic.ctbcnetsuper.| 
joined #anti secRedHack 

05:05 -!- XtmwX [sangue@kerpia-A28DD415.xd~dynamic.ctbcnetsuper J 
[User quit: -=[H2k script]=- The best of script. Get at: www.s2T 
05:39 sangue [sangue©kerpia-A28DD415.xd-dynamic.ctbcnetsuper,| 
joined #anti secRedHack . 
05:39 -!- sangue [sangue®kerpia»A28DD415.xd-dynamic.ctbcnetsuper| 
#anti secRedHack [] ^^^^^^ 

09:30 -!- recrec [recrec@kerpia-2D£7230D.gwBHMH net l nas joined 
#an ti secRedHa c k 




has 
has 
has 



quit 




has quit 
k. host.sk] 
has 

has quit 

k ^ 

has 
has left 



recrec [recrec@kerpia-2D£7230D«gw 




net] has left #anti secRedHack 



09:30 
[Leaving] 

17:34 -!- sabu [sabu@security.anonymo.us] has left #anti secRedHack [] 
— - Log closed Tue Jan 31 17:34:41 2012 
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8/13/13 Conversation with \ohoho@i*ber.ccc.de 2i 1/23/2012 12:50:07 PM on LeonDawcteon@j3bber.org/j^ier.c» , g (jabber) 



Conversation with yohoho@jabber.ccc.de at 1/23/2012 12:50:07 PM on 
LeonDavidson@jabber.org/jabber.org (jabber) 

(12:50:09 PM) Ieondavidsoa@]abS>enos^/jabber.oi^: yoooooooooooooooo 

(12:50:11 PM) Ieondavi*ion@jabber,org/jabber-oi^: wake up negro 

(1:49:48 PM.) !e o nda vids o n@ ja bbe r.org/jabfee r.org: yo my mother focking brother at arms 

(i :49:51PM) leoHdavtd$on@jabbenoig/jabber.oig: whats goodie!!!!!!! 

(1:5015 PM) The encrypted message received fromyohoIro@jabber.ccc.de is unreadable, as you are not 
currently communicating privately. 

(l.50:37PM) Unverified conversation with yohoho@jabber.ccc,de/ghost started 

(i:50:39PM) yohoho@jabber.ccc.de: [resent] =)) 

(1:50:45 PM) yohoho@jabber.ccc.de: back 

(l:50:58PM) leondavidson@jabber.org^abber.org: whats good 

(i:5i:07PM) yohoho@jabber.ccc.de: wakingup 

(1:51:33 PM) ieoadavidson@jabber.org/|abber.oi^: good mother fiicker 

(i:5i:33 PM) !eondavidson@ jabber.org/jabber.org: what happenedl ast night? 

(1:51:35 PM) IeGndav3dson@jabber.org/jabber.org; I went out 

(1:51:52 PM) yohoho@jabber.ccc.de: was good 

(l:5i:58PM) yohoho@jabber.ccc.de: hm owned some shit for dvO 

(1:52:22 PM) leondavidson@jabber.org/jabber.org: great 

(1:52:25 PM) leondavi(teon@jaWber.oi^/jabber.org: te| (shit? 

(1:53:10 PM) leondavidson@jabber.org/jabber.org: so I got most/all of that alcohol list cracked 

(1:53:19 PM) leondavidson@jabber.org/jabber.org: but like a dick I didn't save the list, so I have myniggas 

cracking again 

(1:53:20 PM) leondavidson@jabber.org/jabber.org: hahaha 

(l:56:06PM) Ieondavidson@jabber.0i^/jabber*oi'g: hftp^/pastebin.coit^KesAPCUz 

(1:56:08 PM) leondavidsoR@jabber.org/jabber.org: there you go 

(1:56:10 PM) leondavidson@jabber.oi%/jabbenot^: expires in hour 

(i:58:47PM) yohoho@jabber.ccc.de: nice 

(i:58:50PM) yohoho@jabber.ccc.de: hmm 

(1:58:53 PM) yohoho@jabber.ccc.de: what else what else 

(i:58:59PM) yohoho@jabber.ccc.de: cracked another nazi store 

(i:59:08PM) yohoho@jabber.ccc.de: also a german nazi store 

(2:09:34 PM) Ieondavidson@jabber*OFg/jabbenot^; back 

(2:09:38 PM) leondavidson@jabber*org/jabber.ot^: gay ass internet 

(2:09:39 PM) leondavid$on@jabber.org/jabber.org: yo son 

(2:09:41 PM) yohoho@jabber.ccc.de: -) 

(2:09:46 PM) leondavidson@jabber.org/jabber.ovg: you get the 1st? 

(2:09:49 PM) yohoho@jabber.ccc.de: yes I got another list of password hashes 

(2:09:52 PM) yohoho@jabber.ccc.de: 1 sec 

(2:09:57 PM) leondavi<teon@ja'bber.O'£g/jabber.oi < g: ok 

(2:10:00 PM) leondavidson@jabber.OEg/jabber.org: take advatange 

(2:10:02 PM) koRdavidson@jabbcr.org/jabbenorg: my teams online now 

(2:10:07 PM) yohoho@jabber.ccc.de: umra it's on the new server I believe 

(2:10:08 PM) yohoho@jabber.ccc.de: 1 sec 
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8/13/13 Comersalion wth iQhoho@Jabber.ccc.de at 1/23/2012 12:50:07 PM on LeonD avi dson@jabbar.org /jabber . org (jabber) 

(2:10:09 PM) leondavidson@jabber.org/{abbenorg: kk 
(2:15:56 PM) yohoho@jabber.ccc.de: ok it's infl 

(2:16:52 PM) yohoho@jabber.ccc.de: il start festmjj^o^ logins 

(2:17.04 PM) yohoho@jabber.ccc.de : I got a master plan in my head that hits several different kinds of police 

institutions 

(2:17:27 PM) yohoho@jabber.ccc.de : like an online police store, the ankle bracelet manufecturer, a jail soiware 
developer, police forums 

(2:17:38 PM) Ieondavsdson@jabber.erg/jahbenerg: yup 
(2:17:38 PM) yohoho@jabber.ccc.de: trying to getapolice dating/jobs site 
(2:17:41 PM) leondavidsoit@Jabbenorg/jabber.org: grabbing list now 
(2:18:30 PM) leondavidson@jabber.org/jabber*org: in all reality brother 

(2:18:41 PM) Ieoiidavi<kon@jabber.org/jabber.o^^||||^^)u$t get hit in the most beautiful of public display 

(2:18:45 PM) leondavi<kon@jataber.oig^abber*oi , g: a direct anfrgop hit 

(2:18:51 PM) leondavidson^iabber.OTg/jabber.org: and the dating site a hit to both parties 

(2:20:05 PM) yohoho@jabber.ccc.de: yes 

(2:20:11 PM) yohoho@jabbenccc.de: that is a master one 

(2:20:24 PM) yohoho@jabber.ccc.de: in thinking those two targets as it gets closer to the repoublican national 
convention in tampa ilorida 

(2:20:48 PM) Ieondavidson@jabber.org/jabbenorg: when is it? 
(2:22.06 PM) yohoho@jabber.ccc.de: summer I believe 
(2:22:12 PM) yohoho@jabber.ccc.de: or spring 

(2:22:16 PM) yohoho@jabber.ccc.de: so we have a little time to try to get something nice 
(2:22:21 PM) yohoho@jabber.ccc.de: we dorf have mail on them currently 

(2:26:53 PM) leondavJdsQB@jabbenorg/jabber.org: at least we have their login to members, with that we can 
start grabbing spools from these super pac people 

(2:26:58 PM) ieoiMlavidsoi^jabber.org/jabbenorg: I promise they're as corrupt as it gets 

(2:27:04 PM) yohoho@jabber.ccc.de: yes 

(2:27:08 PM) yohoho@jaUber.ccc.de: they're pretty poweful 

(2:27:11 PM) yohoho@jabber.ccc.de: also I looked at the dating site 

(2:27:14 PM) yohoho@jabber.ccc.de: it was hit hard by spammers 

(2:27:26 PM) yohoIio@jabber.ccc.de: there's a few hundreds accounts though 

(2:2738 PM) yohoho@jabber.ccc.de: a few messages 

(2:27:44 PM) yohoho@jabber.ccc.de: but pretty small 

(2:33:04 PM) yohoho@jabber.ccc.de: and the dating passies are in cleartext too 

(2:33:3 1 PM) yohoho@jabbe r.ccc.de : actually they are both md5 and cleartext for some reason 

(2:33:16 PM) !eondavid$on@jabber«org/jabbenorg: not bad 

(2:33:33 PM) leondavidsoR@jabber.Grg/jabber.oi^: hows the new nazi targets? 

(2:33:35 PM) Ieondavkbon@^kbber.org/jabber.org; also mynigga 

(2:33:37 PM) yohoho@jabber.ccc.de : it's not that popular of a site though so there's probably no big names or 
anything ^^^^^ 
(2:33:47 PM) leondavidson@jabbenoi^/jabber.org: hit these bitches for om| fsquad: 

(2:33:48 PM) leondavtdson@jabbenorg/jabber»oi%: one sec 

(2:33:49 PM) yohoho@jabber.ccc.de: it's good, a tot of US nazi addresses that were previously unknown 
(2:34:48 PM) Ieondavidson@jabber.oi^/jabber*org: sites or emails you mean? 
(2:35:10PM) yohoho@jabber.ccc.de: it was another online nazi store 
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8/13/13 Conversation with y3toho@jabber.ccc.de at 1/23/2012 12:50:07 PM on LeonDaMdson@jabber.OTgyjabb6r.org (jabber) 

(2:35:19 PM) yohoho@jabber.ccc.de: and it has home addre sses of ppl who bought shit 

>/iabbenorg: for ourl 





(2:36:55 PM) yohoho@jabbenccc.de: ahhk 

(2:37:08 PM) yohoho@jabber.ccc.de: I can take a took at that 

(2:37:09 PM) yohoho@jabber.ccc.de: also 

(2:37:1 8 PM) yohoho@jabber.ccc.de: when afex or someone else with lots of windows voodoo gets on 

(2:3722 PM) yohoho@jabber.ccc.de: I got a major target for us that needs work 

(2:37:29 PM) yohoho@jabber.ccc.de: but I'm not best at windows 

(2:37:34 PM) yohoho@jabber.ccc.de: it's windows plesk target 

(2:37:55 PM) leondavidson@jabbenot^/jabbenoi^: yeah plesk is for lags 

(2:37:55 PM) yohoho@jabber.ccc.de: we need to dump dbs files etc mails not on this box so we'd have to try 
that 

(2:37:59 PM) yohoho@jabber.ccc.de : a major private prison shit 
(2:38:00PM) kon(Iavidson@jabber.oi^/jabber.oi^: I'E let alex know 
(2:38:14PM) yohoho@jabberxcc.de: yeal^hen^^iknMhithimiq) 
(2:43:59 PM) yohoho@jabber.ccc.de: ok| Is ownable 

(2:44:04 PM) yohoho@jabber.ccc.de : checing others now 
(2:44:23 PM) leondavidson@jabbenorg/jabber.org: kk 

(2:45:28 PM) yohoho@jabber.ccc.de: will they be able to do all the work on these targets? 
(2:45:31 PM) yohoho@jabbe rxcc.de: dump mail/sql 

(2:45:44 PM) yohoho@jablter.ccc.de: should I just give tem backdoor urls and shit 

(2:45:5i PM) Seondavidson@jabber.oi^/jal?her.02^: yup 

(2:45.53 PM) leondavidson@jabber.org/jabber.org: they're doing all work 

(2:46:01 PM) leondavidson@jabber.oi^/jabber.org: just backdoor urls with suidbin rootshell 

(2 46:03 PM) leondavidsoii@jabbera)rg/jabber.org: that hould be enough 

(2:46:06 PM) yohoho@jabberxcc.de: k 

(2:46:54 PM) yohoho@jabberxcc.de: ugh flicking windows 

(2:46:59 PM) yohoho@jabberxcc.de : i'l just give thempasswords for this windows targe 
(2:47:I0PM) leondavid$ou@jabbenorg/jabbenoig: g4y 
(2:47:52 PM) yohoho@jabberxcc.de : 




(2:47:54 PM) yohoho@jabberxcc.de: shiiit 
(2:47:59PM) leondavtdson@jabber«org^|abber.org: WIN^^^ 
(2:48:10 PM) leondavidson@jabber.oi^/jabber.org: 287 | |? 
(2:49:52 PM) yohoho@jabber.ccc.de : i'll see in a min what the domains are 
(2:49:53 PM) yohoho@jabberxcc.de: maybe random 

(2:5l:00PM) leondavidson@jabber.org/jabber*ot^: hope its | (that'll be a big ass hit 

(2:51:16PM) jcondavidson@jabber,org/jabber.org: our boy thats been ddosing and hacking 



>ast few 
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8' 13/1 3 Cornersation with yohoho@jabber.ccc.de al 1/23/2012 12:50:07 PM on LeonDaMdson@jabber-org/}abber.org (jabber) 

days gonna handle it 

(2:51:19 PM) le onda vids o n@ jabhe r.org/jabbe r.org ; havitja 
(2:51:23 pm) leondavidson@jabbcnoi^/jabber.org: hes been on a rampage 

(2:51:44 pm) leondavidson@jabber.oi^/jabber.org: 2 dozen defacements, been ddosing all opmegaupfoad 
targets 

(2:5i:47PM) yohoho@jabber.ccc.de: its got domains like| 
(2:51:51 PM) 1eondavidsoii@jabbenoi^/jabber B org: I see 

(2:52:30 pm) leondavidteon@jabbenorg/jabber.org: I guess just backdoor and rootshell and pass it alone and 

work on next, let them niggas figure it out 

(2:52:37 PM) yohoho@jabber.ccc.de: ok 

(2:52:39 PM) yohoho@jabber.ccc.de: how about 

(2:52:49 PM) yohoho@jabber.ccc.de: a bigass lump of XML data 

(2:52:57 PM) yohoho@jabber.ccc.de: which contains all the fip passwords and other info about every domain 
(2:54:05 PM) le0ndavid$oit@jabber.oi^ja hher.org: (hat works too 
(2:54:06 PM) leondavidson@jabber.oi^/]abber.org: haha 
(2:54:20 PM) yohoho@jabber.ccc.de: for windows targets anyway 
(2:54:27PM) yohoho@jabber.ccc.de: linux ones 21 pass offthe suid webshelb 
(2:54:32 PM) yohoho@jabber.ccc.de: uploading to priv8haha now 
(2:54:36 PM) leoitdavidsoD@jabbenoi^/jabber.oi^: kkthx brother 
(2:54:36 PM) yohoho@jabber.ccc.de: on that one target 
(2:54:47 PM) yohoho@jabber.ccc.de :\ 
(2:54:55 PM) yohoho@jabber.ccc.de: I 

(2:55:>12PM) yohoho@jabber.ccc.de: [0] ^> SimpleXMLElement Object 
( 

[name] => flp_login 
[value] =>P 

) 




[1] => ShipbXMLElement Object 
( 

[name] ~> ftp password 
[value] => | 

(2:55:55 PM) yohoho@jabbenccc.de: [0] *> SirrpleXMLElement Object 
( 

[name] => ftp logfc 
[value] =>[ 

) 




[1] => SimpfeXMLElement Object 
( 

[name] => ftp password 
[value] =>| 
) 

<- fori 

(2:55:58 PM) yohoho@jabber.ccc.de: fose are the only .gvovs 
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8/13/13 Conversation vsith yohoho@aKjer.ccc.de at 1/23/2012 12£0c07 PM an UonDaMdson®abber.org/iabber.org (jabber) 

(2:56:11PM) leoiidavidsoji@jabber,oi^/jabber 0 org; ok bet^^^^^^^^^ 

(2:56:33 PM) yohoho@jabber.ccc.de: and the others will be | (when it's done uppn 

(2:56:45 PM) leondavidson@jabberiiOi^/jabber.oi^ thx brother 

(2:56:48 PM) leofldtevidson@j^bher.or^^ apreciate this 

(2:58:16 PM) yohoho@jabber.ccc.de :| (*ooted 

(2:58:28 PM) leoBddvidson@jabber,org/jabber*oi^: SEX 

(3:02:39 PM) yohoho@jabber.ccc.de: well that's it unfortunately 

(3:02:41 PM) yohoho@jabber.ccc.de: just those two 

(3:02:58 PM) yohoho@jabber,ccc.de: there are versions that are patched 

(3:03:03 PM.) lcondavidsoii@j«*bber.org/jabbenoig: got you 

(3:03:07 PM) yohoho@jabber.ece,de : h says pfesk is aware of vuh 

(3:03:15 PM) teondavidsoii@JalHber.org/jabber.org: thanks. TTL let you know of any others 

(3;03:16PM) yohoho@jabber.ccc.de: so we have a limited timeframe 

(3:03:27PM) yohoho@jabbenccc.de: i'llpass on this target in a mb 

(3:04:51 PM) leondavidbon@jabber*org/jabber.org: 1^^^^^^^^^^^^^ 

(3:05:30PM) !eoridav3dson@jabber.o.rg/]abber.org:(^^^^^^^^^^^| :: " plesk 

(3:05:33 PM) leoiidavMs(>o@jahber.org/j^bber.org: snis platform 

(3:06:03 PM) Ieondavidson@jabber.org/jabber«oi%:^|^^^^^ urlshortener 

(3:06:2! PM) yohoho@jabber.ccc.de: textback — owned 

(3:06:36 PM) leondavtdson@ jabber.org/jabber.otg: kk 
(3:07:02 PM) yohoho@jabber.ccc.de: no oo5 tho 
(3:07:49 PM) yohoho@jabber.ccc.de: keep comin with them tho =) 
(3:09:01 PM) icondavid5on@jabber.org/jahber.org: 
(3:10:24 pm) leondavidson@jabber.os^/jabber 0 ©rg: | 
(3:10:25 PM) leondavidson@ jabber.org/jabber.oirg; grab that 
(3:10:38 PM) leondavidson@jabber.oig/jabber a org: coolvhosts for efhetsex 
(3:i0:39PM) leondavkisoii@jabber.org/jabber.org: ;) 
(3:10:51 PM) yohoho@jabber.ccc.de: fol 
(3:11:12 PM) yohoho@jabber.ccc.de: got it 
(3:ll:17PM) leondavidson@jabber,oi^/jabber.org: win 
(3:11:22 PM) leondavkbon@^bber»oi^/jabber.org: see what other domains it got 
(3:12:22 PM) yohoho@jabber.ccc.de: a fuckload 
(3:13:23 PM) yohoho@jabberxcc.de: total 3520 



drwxr-xr-x 872 root rool 
drwxr-xr-x 9 root root 
drwxr-xr-x 3 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 toot root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 



18 16:39 . 
2009.. 
VIay7 2009 
fov8 10:27 
Jov8 1027 
sc 18 2009 
lay 1 1 20 
Sep 19 1627| 
Ian 28 2011 
Jan 27 2011 
lay 1 1 200 
bee 9 2010 
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xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XT- 
XI- 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xi- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
•XT- 
XT- 
XT- 
XT- 
xr- 
xr- 
xr- 
xr 
•xr- 
•xr- 
•xi- 
•xr 



x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root roofl 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root] 
x 4 root roofl 
x 4 root rood 
x 4 root roofl 
x 4 root roou 
x 4 root rooD 
x 4 root rooa 
x 4 root vooi 
x 4 root vooi 
x 4 root root 
x 4 root rooi 
x 4 root rooj 
x 4 root rooi 
x 4 root rooi 
x 4 root rooi 
x 4 root rooi 
x 4 root rooj 
x 4 root rooj 
x 4 root rooj 
x 4 root rooj 
x4 root rooj 
x4 root rooj 
x4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
x 4 root rooj 
•x4 root rooj 
•x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
■x 4 root rooj 
-x 4 root rooj 
■x 4 root rooj 
-x 4 root rooj 
x 4 root rooj 
•x 4 root rooj 
-x 4 root rooi 



lay 11 2005 
lay 1 1 2005 
^ug 3 1 2009| 
\Aay 1 1 2005 
vlay 11 2005 
layll 200< 
lay 11 2005 
lay 14 2005 
fun 26 20091 
luii 26 20091 
[an 12 201; 
Fan 12 201: 
lay 11 2005 
lay 1 1 2005 
lay 11 2005 
lay 11 2005 
vfay 1 1 2005 
day 11 2005 
vlay 1 1 2005 
lay 11 2005 
lay 11 2005 
lay 11 2005 
lay 1 1 2005 
vlar 24 201! 
lay 11 2005 
)ec4 2009[ 
Nil20il| 
vlay 11 2005 
Sep 28 142'] 
)ec27 11: 
^ug26 02:2" 
lay 11 2005 
lay 11 2005 
lay 11 2005 
vlar 1 201 ; 
fun 30 201: 
Jaia6 201l| 
Jan 27 201: 
lay 1 1 200^ 
-eb 3 201 : 
rfay 1 1 2003 
lay 11 200 i 
lay 11 200| 
)ct 25 20091 
3C 14 15: 



1i1e///C:/Log Files Juiy2011 to March 2012iJabbenJabbwAeon*^^ 



10499F 4 



8/13/13 

drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drvvxr- 
drwxr- 
dnvxr- 
drwxr- 
drwxr- 
drvvxr- 
drwxr- 
drvvxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drwxr 
drwxr- 
drwxr 



Case 1 :1 2-cr-001 85-LAP Document 69-2 Filed 04/1 6/1 4 

ComarsatlQrrAith \ohoho@jabber. 



Page 8 of 31 

3/jabber.crg (jabber) 



xr- 
xr- 
xr~ 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr* 
xr- 
xr- 
xr- 
xr 



x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x4 root root I 
x4 root root I 
x4 root root! 
x 4 root root I 
x4 root root I 
x 4 root root I 
x4 root root I 
x 4 root root I 
x 4 root root! 
x4 root root I 
x 4 rootrootl 
x 4 root root I 
x 4 rootrootl 
x4 rootrootl 
x 4 rootrootl 
x 4 rootrootl 
x 4 rootrootl 
x 4 rootrootl 
x 4 rootrootl 
x 4 root rootl 
x 4 rootrootl 
x 4 rootrootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
•x 4 root rootl 
•x 4 root rootl 
•x 4 root rootl 
•X 4 root rootl 
x 4 root rootl 
•x 4 rootrootl 
■x 4 root rootl 
•x 4 root rootl 
•x 4 root rootl 
-x 4 root rootl 



ay23 2( 
8 2009| 
iy 1 1 200S 
ayll20C 
1 2009f 
ay 11 20091 
ay 11 2009 
ayll 2009j 
ay 11 20(K 
pr 22 201; 
ay 11 201J 
j!21 2011 " 
lay 11 20C 
ay 11 2009 1 
ay 11 2( 
ay 11 2009| 
ov3 2010f 
lay 11 20091 
lay 1 1 20091 
lay 1 1 20091 
lay 1 1 2009] 
16 201: 
16 201 
ay 23 20101 
ay 11 2009 
ayll2009| 
ay 112C 
ay 11 2009| 
eb 21201. 
lay 11 2009| 
ay 11 200^ 
|un9 2009p 
ay 11 2009| 
ep 19 14;: 
fay 11 20091 
ay 11 2009 
ay 11 2009 
ay 11 20091 
ay 11 20091 
lay 11 2009| 
lay 11 200< 
un26 2005 
lay 112009| 
8 2009|~~^ 
ul 8 20091 



Ian 



lul 



file;>//C:/Log Files July2011 to March 20l2flabber/jabber/le^ 



104993' 



8/13/13 

drwxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr* 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr 
drwxr 



Case 1 :1 2-cr-001 85-LAP Document 69-2 Filed 04/1 6/1 4 Page 9 of 31 

Conversation v^th vohoho@jabber.ccc.de at 1/23/2012 12:50:07 PM on LeonD avidsoi-j@jabber.org /jabber. org (jabber} 



xr- 
xr- 
xr- 
xr- 
xr- 

XI- 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XT* 

xr- 
xr* 
xr- 
xr 
xr- 
xr- 
•xr- 
•xr- 
•xr- 
xr 
xr 
•xr 
•xr- 
xr 
xr 
xr 



x 4 root rootl 
x 4 root root! 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root rootl 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rootl 
x 4 root rootl 
x 4 root rood 
x 4 root rood 
x 4 root rood 
•x 4 root rood 
x 4 root rood 
•x 4 root rood 
•x 4 root rood 
-x 4 root rood 
•x 4 root rood 
-x 4 root rool 
-x 4 root rood 
•x 4 root rooj 
-x 4 root rooj 
•x 4 root rood 
•x 4 root rood 
-x 4 root rood 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 9 root rooj 
-x 4 root rooj 
-x 4 root rood 



lay 11 20091 
vlay 1 1 20091 
ipr 16 2011 
iep 2 022f 
Lpr 16 2011 
iop 19 1629| 
Sep 19 14:: 
tog 17 02:2$ 
tog 18 02: 
tog 13 2010| 
lay 11 200S 
lay 11 200S 
Vug 10 20091 
tog 10 2009 
tog 10 2009 
jgl0 2009| 
5c7 201( 
Jep 5 13:1; 
lay 11 20C 
May 11 200$ 
vlay 11 200$ 
Iov30 11: 
vlay 1 1 200$ 
Marl 201l" 
vlarl 201 
Iovl8 12: 
N27 20K 
vlay 1 1 200$ 
lay 17 20K 
lay 1 1 200$ 
lay 1 1 200$ 
4ay 1 1 200$ 
vlay 1 1 200$ 
lay 1 1 200$ 
lay 11 200$ 
lay 1 1 200$ 
lay 11 200$ 
vlay 19 200$ 
lay 19 200$ 
Dec 6 2329 
Jep 12 142$ 
Dec 12 20091 
vlay 7 2009. 
lay 1 1 200$ 
lay 11 200$ 



filerf/C^Log Files July 2011 to March 2Q12tfabbeM8bber/leo^^ 



104994* 4 



8/13/13 

drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drvvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
dtwxr-xr* 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 
drwxr-xr 



Case 1:1 2-cr-00185-LAP 

Con\^alicr^th vctioho@jabbef 

x 4 root root! Ban 23 201 



Document 69-2 



Filed 04/16/14 Page 10 of 31 

;g/jat*er.org Gabber) 



x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root root 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root root 
x 4 root root 
•x 4 root root 
x 4 root root 
■x 4 root root 
•x 4 root rootl 
•x 4 root root 
•x 4 root root] 
•x 4 root root 
•x 4 root roon 
•x 4 root root] 
•x 4 root root 
•x 5 root rootl 
•x 4 root rood 
•x 4 root rooi 
•x 4 root root 
•x 4 root root 
•x 4 root root 
•x 4 root root 
•x 4 root roo« 
•x 4 root root 
•x 4 root root 
-x 4 root roou 
-x 4 root root 



Pet 



[ul 24 2009 
ov 30 09:2 
ay 1 1 2009 
ep 20 1629 
U13 2009 
ay 1 1 2009 
ay 11 2009 
lay 11 2009| 
ar22 2010 
pr 1 201 
ay 19 20091 
toy 11 2009| 
unl0 201 
ay 1 1 20091 
ay 1 1 2009| 
pr 16 2010 
ov5 2010 
.lay 1 1 20091 
lay 1 1 2009J 

3 2010 
>ec29 2010 
eo 30 2010 
ov6 2009 
ct 13 2010 
lay 11 200 
lay 11 200 
ay 11 200 
ay 11 200 
ay 11 200 
lay 11 200 
lay 1 1 200 
ill 26 02:3 
*.pr22 2009 
ov26 20091 
g31 02 
ct 13 2010 
lar8 2010[ 
lay 12 201 
lay 11 200 
larl7 201 
ay 26 201 
.lay 20 200 
ay 11 200 
y 1 1 200 




file:///C:/Log Flies July 2011 to March 2Q12fiabberflabb^ 



104993' 7 ' 



8/13/13 

drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 



Case 1:1 2-cr-00185-LAP Document 69-2 Filed 04/16/14 Page11of31 

Conversation with 5©hoho@jabber .ccc.de at 1/23/2012 12:50:07 PM on Leor^SMdaon^abber-orgflabbw.ca-g (jabber} 



xr- 
xr~ 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XT- 

xr- 

xr- 
xr 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr 
xr- 
xr- 
xr- 
xr- 
xr 
xr 
xr 
■XT' 
xr 
xr- 
xr 

•XI* 

•xr 



x 4 root root 
x 4 root root 
x 4 root rootl 
x 4 root root 
x 4 root rootl 
x4rootroofi 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root rooB 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root rooj 
•x 4 root root 
x 4 root rooj 
•x 4 root rooj 
x 4 root root 
•x 4 root root 
•x 4 root root 
•x 14 root rod 
x 4 root rooj 
x 4 root rooj 
•x 4 root roofl 
x 4 root rool 
x 4 root rool 
•x 4 root rooj 
-x 4 root rooj 
-x 4 root rool 
•x 4 root rool 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
-x 4 root rooj 
•x 4 root rooj 
-x 4 root rooj 
-x 4 root rool 



L y 1 1 2009| 

ar 24 201: 
ov21 12:3( 
pr 14 201 
ay 11 2009| 
ay 27 201 
ay 27 201 : 
ug3 2010 
ay 1 1 200$ 
ay 11 200$ 
pr 13 201 : 
ep 28 14:30| 
ay 11 200$ 
ar 18 201: 
ec3 2130. 
ec 29 20 H 
c 7 2010 
lar 16 20101 
ay 11 200$ 
day 11 200$ 
-lay 11 200$ 
ov22 2009| 
4ay 11 200$ 
)ct 15 20101 
Dec 22 20l| 
day 11 200$ 
lay 11 200$ 
ay 11 200$ 
ay 11 200$ 
ar5 2010[ 
■lay 11 200S 
lay 11 200$ 
lay 1 1 200$ 
ovll 20K 
8 2009 dv 
ep20 16:3) 
ep 20 14:31 
lay 11 200$ 
lay 11 200$ 
lay 1 1 200$ 
ay 12 201: 
lay 11 200$ 
ay 11 200$ 
26 2009 
ay 11 200$ 



lun 



file:///C:/Log Files July 2011 to March 2Q12i5abberflabberflecfid^ 



10499$' 



Case 1:1 2-cr-00185-LAP Document 69-2 Filed 04/16/14 Page 12 of 31 



8/13/13 

drwxi-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
dnvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr 



Con^ rsation 

x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x4 root root 
•x4 root root 
•x 4 root root! 
x 4 root root 
x 4 root root 
*x 4 root root 
-x 4 root root 
-x 4 root root 
•x 4 root root 
-x4 rootrootl 
•x 4 root roo 
•x 4 root roo 
-x 4 root roo 



viith yohchc@jabbcT.ee 

ay II 2009 
ay 11 2009] 
a3 2010p 
m42010 
3 20101 
to 9 10:3: 
ay 11 2009 1 
ay 1 1 200C 
|Lin4 2010r 
ay 11201 
ar 23 2010 1 
lay 11 2009J 
n9 10:33 \ 
lay 11 2009 1 
17 2009| 
ay 1 1 20091 
ay 11 2009 
ep20 14:31 
ep20 14:32 
ay 11 2009 
ay 11 2009 
ay 11 2009 
ay 1 1 2009| 

16 2009 \ 
lay 11 20091 
lay 1 1 200g| 
ec5 13:31.r 
ov 5 20091 
ar 31 201( 
■ec 10 20091 
ar29 20101 
ul 8 2009 1 
an 12 2011 
lay 11 20091 
lay 11 20091 
ay 1 1 20091 
ay 11 20091 
ay 11 200g| 
ar 9 201 Of 
lay 11 20091 
ay 11 20091 
ay 11 20091 
ay 1 1 2009| 
ct 26 2010 
ay 1 1 20091 



fifei/ACJLog Files Jiiy»11 to Madi2(M2flabberj5ab!^/leor^Mdscxi@atto.org/iOhohc@jabber.^^^ 



10499V' 



#13/13 

drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
dnvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr* 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr 



Case 1:1 2-cr-00185-LAP Document 69-2 Filed 04/16/14 Page 13 of 31 

Con\ersErtlonvyithio|y)ho@jabber.ccc.cte at 1/23/2012 12:50:07 PM on LeonDavidson@abber.orgj5Bbber.org (jabber) 



XT- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xx- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XX'- 
XT- 

xr- 
xr 
xr- 
xr- 
xr- 
xr- 
xr- 
xr 
xr 
■XT- 
XT- 
xr 
•xr- 



x 4 root root! 
x 4 root root! 
x 4 root root| 
x 4 root root 
x 4 root root 
x 4 root root 
x4rootroot| 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x4rootrootj 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root! 
x 4 root rood 
x 4 root rood 
•x 4 root rood 
•x 4 root rootl 
•x 4 root root 
•x 4 root root! 
x 4 root roofi 
•x 4 root rood 
x 4 root rood 
x 4 root rood 
•x 4 root rood 
x 4 root rood 
x 4 root rood 
•x 4 root rood 
•x 4 root rood 
-x 4 root rood 
x 4 root rood 
-x 4 root rood 
-x 4 root rood 
•x 4 root rood 
•x 4 root rood 
-x 4 root rood 
■x 4 root rood 
-x 4 root rood 
■x 4 root rood 
-x 4 root rood 
•x 4 root rood 
•x 4 root rood 



lay 11 20091 
]4ayll2009| 
Feb 12011 
iep 9 2010| 
Ian 12 201: 
lar24 201! 
lay 11 2009| 
[day 1 1 200$ 
^pr 16 2010| 
lay 11 200$ 
lay 11 200$ 
dar 16 20101 
day 11 200$ 
^layll20Q$ 
lay 11 200$ 
lay 11 200? 
(day 11 200$ 
\ug23 200<j 
vlar3 20i: 
lay 1 1 200$ 
lay 11 20C 
N 14 2010| 
lay 11 200$ 
Jov26 20091 
Jov26 200$ 
fov26 200$ 
Iov26 200$ 
Jun 15 2009 
lay 1 1 200$ 
lay 11 200$ 
far 26 205 
lay 1 1 200$ 
fan 21 2010 
lay 11 200$ 
lay 11 200$ 
dayl! 200S| 
lay 11 200$ 
lay 11 200$ 
Fan 11 23:321 
lay 11 200$ 
lay 18 201: 
(day 11200$ 
lay 11 200$ 
lay 11 200$ 
lay 11 200$ 



file:///C:/Log Files July 201 1 to March 2012flabber/Jabber/leon^ 



104998™ 



8/13/13 

drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root rootl 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root 
drwxr-xr-x 4 root root| 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
drwxr-xr-x 4 root roo 
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lay 11 2009 
lay 11 2009 
lay 11 2009 
lay 1 1 2009 
Way 11 2009 
Way 1 1 2009 
lay 1 1 2009 
lay 1 1 2009 
lay 1 1 2009 
lay 1 1 2009 
Way 1 1 20091 
[lay 11 20091 
lay 1 1 2009 
[lay 11 2009 
[lay 1 1 2009 
lay 11 2009 
lar30 2010 
War 30 2010 1 
|un 16 2009: 
Way 11 20091 
[lay 11 20091 
lay 11 20091 
fovl5 2009 1 
lay 1 1 20091 
lay 1 1 2009| 
Jovl8 123: 
|unl5 2011 
lay 11 20091 
lay 11 20091 
Way 11 2009] 
lay 11 20091 
[lay 11 20091 
Way 11 2009| 
^pr2 2010| 
klayll 200< 
luii 23 20 10 1 
[lay 11 20091 
lay 11 2009| 
lay 11 200S 
lay 24 20111 
Jov26 2010| 
)ct31 20:3 
Way 1 1 200< 
Jul 10 2010f 
kil 1 200S 



file:///C:/Log Files July2011 to March 2012fjabba7jabber/leon^^ 



10499? 74 
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drvvxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr- 

drwxr-xr 

drwxr-xr 

drwxr-xr- 

drwxr-xr 

drwxr-xr- 

drwxr-xr 

drwxr-xr- 
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x 4 root root! 
x 4 root root! 
x 4 root rootl 
x 4 root root! 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root root 
x 4 root rootl 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root rootl 
x 4 root rootl 
x 4 root root 
x 4 root root 
x 4 root root] 
x 4 root rood 
x 4 root rood 
x 4 root rootl 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
•x4 root rood 
x 4 root rood 
x4 root rootl 
■x 4 root rood 
x4 root rood 
x4 root rood 
x4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
•x 4 root rood 



[ul 



ov 26 201 ( 
fey 11 20091 
pr 17 2010 [ 
pr 17 2010 1 
ug27 02: 

31 02331 
ay 11 20091 
ay!1 2009| 
ct21 16: 
ct21 16' 
ov2 18:34: 
lay 11 20091 
lay 12 20K 
ay 11 200$ 
9 20K)P 
lay 1 1 200$ 
!ay 11 200$ 
ay 11 200$ 
ay 11 200$ 
ay 11 200$ 
ay 1 1 200$ 
y 11 200$ 
ct 23 20091 
ep 14 16:: 
ec 14 20101 
lay 11 200S( 
>ecl0 2010| 
©c 7 2010. 
'ec 10 20101 
eb6 20i: 
ay 11 200$ 
ay 11 200$ 
ov27 200$ 
lay 11 200$ 
ay 11 200$ 
ep 27 20K 
ay 11 200$ 
;ayU 200$ 
<eb 16 20101 
an 19 2010| 
ay 11 200$ 
lay 11 200$ 
lay 11 200$ 
ec 1 2010f 
lay 20 20K 
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drwxr-xr- 
drwxr~xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drvvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drvvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr~xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr 
drwxr-xr- 
drwxr-xr- 
drvvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr 
drwxr-xr- 
drwxr-xr- 
drwxr-xr 
drwxr-xr 
drwxr-xr- 
drwxr-xr 
drwxr-xr 
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x4 root root! 
x 4 root root I 
x 4 root root I 
x 4 root root I 
x 4 root rootl 
x 4 root root I 
x 4 root root! 
x 4 root root I 
x 4 root root I 
x 4 root rootl 
x 4 root rootl 
x 4 root root I 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x4 root rootl 
x 4 root rootl 
x 4 root rootl 
x4 root rootl 
•x 4 root rootl 
x4 root rootl 
x 4 root rootl 
x 4 root rootl 
•x 4 root rootl 
-x 4 root rootl 
•x4 root root 
•x 4 root root 
•x 4 root root 
•x 4 root root 
-x 4 root root 
•x 4 root root 
•x 4 root rootl 
•x 4 root rood 
•x 4 root rood 
•x 4 root rood 
•x 4 root rood 
-x 4 root rood 
•x 4 root rood 



lay 1 1 2009 
lay 1 1 20091 
[day 11 2009 
|*ay23 201 o| 
^ug7 2009p 
|Iay 1 1 2009j 
jul 8 2009 
111 8 2009 1 
Jov 1 2010| 
)ecl8 2010| 
Iul5 201( 
}eb 9 20111 
|day 1 1 2009| 
Iar8 201( 
lar8 201< 
|un!6 2005 
faogS 2011 
)ec 29 20101 
lay 11 2009J 
Jim 16 2009 f 
fax 16 2009 
|un 16 20091 
lay 25 201: 
|unl9 2010: 
lov 24 20091 
May 11 2009| 
If ay 11 20C 
Ian 5 201 if 
lay 11 20091 
lay 11 2009| 
Iun26 20091 
Iun26 20091 
fun 25 20091 
tun 25 2005 
lay 11 200S 
lay 11 200S 
lay 1 1 200S 
(toy 11 200$ 
lay 17 20K 
|wfay 11 200S 
lay 24 200? 
)ct28 20091 
vlay 1 1 200S 
lay 11 200S 
lay 11 200S 
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drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr 
drwxr- 
drwxr 
drwxr 
drwxr 
drwxr 
drwxr 
drwxr 
drwxr 
drwxr 
drwxr 
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xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xi- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr 
xr- 
xr- 
xr- 
xr- 
xr- 
XT- 
XT- 
•xr- 
xr 
•xr- 
•xr- 
xr 

•XT' 

•xr 
•xr 
xr 
-xr 



x 4 root rood 
x 4 root root 
x 4 root roofi 
x 4 root rooi 
x 4 root root 
x 4 root rooo 
x 4 root rooQ 
x 4 root rood 
x 4 root roofl 
x 4 root roou 
x 4 root rooB 
x 4 root roofl 
x 4 root rooi 
x 4 root rooj 
x 4 root rooi 
X 4 rootrooj 
x 4 root rooi 
x 4 root rooi 
x 4 root rooj 
x 4 root rooi 
x4 rootrooj 
x4 rootrooj 
x4 rootrooj 
x 4 root rooj 
x 4 root rooj 
x 4 root rooj 
x 4 root rooj 
•x 4 rootrooj 
•x4 rootrooj 
•x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
•x 4 root rooi 
•x 4 root rooj 
•x 4 root rooi 
-x 4 root rooi 



uJ 



ay 11 200$ 
ay 11 2005 
ec 16 20101 
ct27 2009 
ct27 2009 1 
ay 11 200$ 
pr7 201 
ar26 20101 
'ec 4 2009| 
)ct23 20091 
ovl6 12: 
[ay 11 200$ 
lay 11 200$ 
ay 1 1 200$ 
4 20K 
ov22 201 
3ct 12 14:! 
)ct20 16: 
ct20 14: 
Dct20 14: 
ay 1 1 200$ 
ay 11 200$ 
ay 11 200$ 
ay 11 200$| 
Junl8 2010 
ay 11 200$ 
an 18 2010 
ay 1 1 200$ 
ep 20 16:: 
ep 19 16: 
lay 1 1 200$ 
lay 1 1 200$ 
ov27 200$ 
ul21 201 
ov27 200$ 
ul21 201 
ov27 20® 
iil21 201 
Ian 11 09: 
May 11 200^ 
May J 1 20()J 
^lay 1 1 20oJ 
ay 11 2005 
ay 11 200 \ 
ec 14 201 ( 
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8/13/13 

drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
diw 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr 
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XV- 
XV 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XT- 

xr- 
xr- 

XI* 

xr 

•XI'- 

•xr- 
•xr- 
•xr- 
•xr- 
•xr- 
•xr- 
•xr- 

-XI"- 



x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x4rootroot| 
x 4 root root 
x 4 root rootl 
•x 4 root root 
•x 4 root rootl 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
•x 4 root rootl 
•x 4 root roo 
•x 4 root roo 
•x 4 root roo 
•x 4 root roo 
•x 4 root rooi 
•x 4 root roo* 
•x 4 root roo 
•x 4 root roo" 
•x 4 root roo 
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ay 19 201 
14 2010 
ay 11 200 
in 28 201 
lay 1 1 2009 
lay 1 1 2009 
ay 11 2009 
ay 1 1 2009 
lay 13 201 
ay 1 1 200,9. 
Iul23 201 

10 2010 
eb 17 2010 
ay 11 2009 
y 11 2009 
:ar4 201 " 
ay 11 2009 
ay 11 2009 
ay 11 2009 
ct7 2009 
ay 1 1 2009 
ec 6 201 of 
ec 6 201 
lay 11 2009 
ov5 2009" 
lay 1 1 200 
lar22 201 
ar22 201 
eb 7 201 
eb 7 201 
eb 7 201 
eb 8 201 
eb 7 201 
eb 7 201 
ay 112009| 
ep 23 2009 
ep 23 2009 
.ug 17 2009 
lay 11 20091 
lay 11 2009J 
an 12 201 
an 12 201 

ay 11 2009J 
Pan 8 2010 
ul 15 201 
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3.'13'13 

drwxr- 
drwxr- 
dnvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
diAvxr- 
drwxr- 
diwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr 
drwxr- 
drwxr- 
drwxr 
drwxr 
drwxr 
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xr- 
xi- 
xr 
XT- 
xT- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr 
xr- 
xr- 

■XT- 
XT- 

•xr- 
xr 
xr 
-xr- 
xr 
•xr- 
xr 
■xr 
xr 
xr 
xr 
xr 
xr 
xr 



x 4 root root I 
x4 root root| 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root rootj 
x 4 root root 
x 4 root root! 
x 4 root roofl 
x 4 root rooB 
x 4 root root 
x 4 root roofi 
X 4 root roon 
x4 rootrooti 
x 4 root root 
x 4 root rooi 
x4 rootroofl 
x 4 root root 
•x 4 root rooj 
•x 4 root rooJ 
•x 4 root roofl 
x 4 root rood 
-x 4 root rooi 
-x 4 root roofl 
-x 4 root rooi 
-x 4 root rooj 
-x 4 root rooj 
■x 4 root rooj 
-x 4 root rooj 
•x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
•x 4 root rooj 
-x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
■x 4 root rooj 
-x 4 root rooj 
-x4 root rooj 
•x4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
-x4 root rooj 
-x 4 root rooi 



ep30 20ii 
ay 11 200$ 
ay 11 200$ 
lay 1 1 200$ 
lay II 200$ 
ug20 201 ( 
ay 1 1 200$ 
ar 15 20101 
ay 11 200$ 
ay 11 2005 
4ayll 200$ 
to 21 201 
ay 1 1 200$ 
}ct31 12; 
/fay 1 1 200$ 
7 eb4 20i: " 
ay 1 1 200$ 
lav 11 200$ 
\pr 16 2010| 
lay 1 1 200$ 
lay 11 2005 
f eb 26 201 ( 
5 201 if 
ay 1 1 2005 
an 3 1201: 
lay 1 1 2005 
ay 11 2005 
ay 1 1 2005 
ay 1 1 2005 
ay 11 200,5 
ep9 201( 
ay 1 1 2005 
lay 1 1 2005 
ul30 2009f 
lay 11 2005 
ay 11 2005 
ay 11 2005 
lay 11 2005 
\pr 19 2010| 
lay 11 2005 
lan 27 201: 
lay 1 1 2005 
lay 11 2005 
/lay 11 2005 
[ay 11 2005| 



M 
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drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
dnvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
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xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XT- 

xr- 
xr- 

XI* 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xi- 
xr- 
•xr- 
xr- 
•xr- 
•xr- 
•xr- 
xr- 
•xr- 
xr- 
xr- 
•xr- 
•xr- 
-xr- 
xr- 
•xr- 
•xr- 
•xr- 
•xr- 
•xr- 



x 4 root rootl 
x 4 rootrootl 
x 4 root rootl 
x 4 root root] 
x 4 root rootl 
x 4 rootrootl 
x 4 rootrootl 
x 4 root rootl 
x 4 root rootl 
x 4 rootrootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 rootrootl 
x 4 rootrootl 
x 4 rootrootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root root| 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root root 
x4 rootrootl 
x 4 root rootl 
x 4 root root 
•x 4 root root 
x 4 root rootl 
x 4 root root 
x 4 root rootl 
x 4 root root 
•x 4 root root 
■x 4 root root 
-x 4 root rootl 
-x 4 root roofl 
-x 4 rootrootl 
■x 4 root root 



lav 11 2009 1 
18 200$ 
lay 11 20091 
lay 11 2009 
War 16 2010 
^layll 2009 
lay 11 2009 
lay 11 2009 
lar23 2010 
lay 11 2009| 
lay 1 1 200J 
iug 2 0238| 
)ct26 2009; 
Way II 20091 
lay 11 20091 
lay 1 1 20091 
|4ay 11 20091 
lay 11 20091 
lay 11 2009| 
)ct5 2009P 
fep!0 2009 
|ul3 2009P 
lay 1 1 2( 
lay 11 20091 
par 18 20101 
Llay312010l 
Llay 11 20091 
Llay 1 1 20091 
Way 1 1 2009| 
[an 6 201 0p 
lay 11 20091 
k4ayll2009| 
fan 16 2009T 
fun 16 20091 
tun 16 20091 
^eb9 2010[ 
?eb 9 2010 1 
Jov 12 20101 
vug 19 1627| 
lay 1 1 200S 
lay 112005 
tec 9 201 (" 
)ec9 201( 
? eb 16 201 
Vug 12 20091 
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drwxr- 

drwxr- 

drwxr 

drwxr- 

drwxr 

drwxr 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drvvxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr- 

drwxr 

drwxr- 

drwxr- 

drwxr- 

drwxr 

drwxr- 

drwxr- 

drwxr 

drwxr- 

drwxr 

drwxr 

drwxr 

drwxr 
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xr 
xr 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XI'- 
XI- 
XI- 
XI- 

xr- 
•xr- 
•xr- 
xr- 
xr- 
•xr- 
•xr- 

•XT- 

•xr- 
•xr- 
•xr- 
xr- 
xr- 
•xr 
•xr- 
xr 
•xr- 
•xr 



x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root! 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
*x4 root rood 
x 4 root rood 
•x 4 root rood 
•x 4 root rood 
•x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rooj 
x 4 root rood 
•x 4 root rood 
•x 4 root rood 
-x4rootroo1 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
•x 4 root rooj 
-x 4 root rooj 
-x 4 root rooj 
•x4 root rooj 
-x 4 root rooj 
-x4 rootrooJ 



ov25 14:! 
eb4 201! 
ar 1 201 ; 
lay 1 1 200$ 
ep 9 2011 
eb25 201 : 
ay 112005 
ay 11 200$ 
ay 11 2009| 
an 26 201 
ul7 2011| 
lay 11 200$ 
ov26 20091 
ov26 20091 
Jov26 20091 
ay 11 200$ 
ug 18 2010| 
iw 18 2010 
ep20 14: 
ep 20 14:: 
ovl8 201( 
an 12 201: 
mil 2009: 
ay 11 200$ 
ep 19 14- 
lay 11 200$ 
fa: 5 2010; 
ug 12 2009| 
3 2010p 
[ay 11 200$ 
ov 2 12391 
lay 14 200$ 
\ug 31 2009| 
ay 11 200$ 
eb3 201] 
y 11 200$ 
y 11 200$ 
ay 11 200$ 
Aug 17 2010| 
:ay27 200$ 
y 11 200$ 
ep 10 2009| 
ay 11 200$ 
lay 11 200$ 
far 30 20K 



ful 
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105008™ 



a/13/13 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drvvxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxp 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr 
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XT- 
XT 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XI- 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr 
xr- 
xr- 
■xr- 
xr- 
xr- 
xr 

XI- 
XT 

xr 
•xr- 
xr 
xr 
■xr- 
•xr- 
xr- 
•xr 

XI- 

•xr 
•xr- 
•xr 
-xr- 
•xr- 



x 4 root root I 
x 4 root root I 
x 4 root root I 
x4 root root I 
x 4 root root I 
x 4 root root! 
x 4 root root! 
x 4 root root! 
x 4 root root I 
x 4 root root I 
x4 root rootl 
x 4 rootrootl 
x 4 root rootl 
x 4 root root I 
x 4 root root I 
x 4 root root I 
x 4 rootrootl 
x 4 root rootl 
x 4 root rootl 
x 4 rootrootl 
x 4 root rootl 
x 4 root rootl 
x 4 rootrootl 
x 4 root rootl 
x 4 root rootl 
x 4 rootrootl 
x 4 root rootl 
•x 4 root rootl 
•x 4 root rootl 
x 4 root rootl 
x 4 rootrootl 
•x 4 rootrootl 
•x 4 root rootl 
•x 4 root rootl 
x 4 root root 
•x 4 root root 
•x 4 root root 
•x 4 root root 
-x 4 root root 
•x 4 root root 
-x 4 root root 
-x 4 root rootl 
-x 4 root root 
•x 4 root roofi 
•x4rootrooti 



lay 11 2009 
vug 30 0239J 
15 2010 r 
1 2009| 
(lay 11 20091 
|4ay 1 1 2009| 

15 200S 
)ct 6 20091 
fep 9 200$ 
f ep 9 200$ 
tag5 02:40| 
J/lay 11 20091 
May 1 1 20021 
}cb9 20i: 
lay 11 2009| 
^ay 1 1 200£ 
^pr3 201i 
tec 6 2010 J 
|4ay 1 1 2009| 
)ct29 2010 
|an28 201: 
\pr 16 201: 
lay 11 20091 
lay 11 20091 
lay 11 2009| 
Har22 20U 
lay 11 20091 
Iun30 20i: 
jlay 14 20091 
Uay 11 2009| 
Ian 27 201: 
rfay 11 20091 
£ep 22 12: 
)ct 19 18:* 
day 1120091 
[toy 11 2009| 
)ct 13 2010 
\fixy il 20( 
)ct9 2009| 
7 ebl0 201. 
^ug26 02- 
fid 8 2009 [ 
lay 11 20C 
run 15 20101 
lay 11 200S 



file.7//C;/Log Files July201 1 to March 2012)abber/jabber/feon^ 



105007*' 



8/1 3' 13 

drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
dnvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drvvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drvvxi-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drvvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drvvxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
drwxr-xr- 
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x 4 root rootl 
x 4 root root! 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root root 
x 4 root rootl 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root] 
x 4 root root 
x 4 root rootl 
x 4 root roofi 
x 4 root rood 
x 4 root roofi 
x 4 root roofi 
x 4 root roofi 
x 4 root roofi 
x 4 root rood 
x 4 root roofi 
x 4 root roofi 
x 4 root roofi 
x 4 root roou 
x 4 root roofi 
x 4 root roofi 
x 4 root roofi 
x 4 root rootl 
x 4 root roofi 
x 4 root rooa 
x 4 root rooo 
x 4 root roofi 
x 4 root rootl 
•x 4 root roou 
x 4 root rood 
•x 4 root rooa 
•x 4 root roou 
•x 4 root roou 
•x 4 root roofi 
•x 4 root roou 
-x 4 root roofi 
x 4 root roofi 
■x 4 root roofi 



Jeb7 2011 
Feb 7 2011 
? eb 7 20111 
Feb 7 201 
day 11 200< 
fun 21 20U 
fov20 201 ( 
Iov2 201l 
pep 21 1654 

ay 11 2005 
Jep20 14:4 
Jov3 2005 
kday 11 2005 
|*fay 1 1 2005 
lov6 2009[ 
\tay 11 2005 
Vlay 1 3 200^ 
7 eb8 20i: 
<eb 28 201 ( 
)ec 24 200< 
lar2 20i: 
lar22 2010| 
lay 11 2005 
Iov30 15; 
Iov30 1535 
fov30 15; 
fay 11 2005 
fay 11 200S 
fay 11 2005 
fay 11 2005 
vlay 1 1 2005 
vlay 1 1 2005 
: eb 16 20101 
Aay 19 2011 
lovll 2005 
Iovl9 201( 
)ct 17 12:4 
vlar21 201 : 
4ay 1 1 200S 
vlayll 20^ 
7 eb 1 201: 
lay 11 2005 
lay 11 2005 
lay 11 2005 
lay 11 2005 
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10500T 4 



8/ 13/1 3 

drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drvvxr- 
drvvxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr- 
dnvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr 
drwxr 
drwxr 
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xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr 
xr 
xr- 
xr- 
xr- 

XI- 

xi- 

XI- 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
•xr- 
•xr- 
xr 
•xr- 
xr 
•xr- 
•xi- 
xr 
•xr 



x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x 4 root rootl 
x4 root rootl 
x4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root rootl 
•x 4 root root 
•x 4 root root] 
■x 4 root rood 
*x 4 root root 
•x 4 root rood 
■x 4 root rood 
-x 4 root rood 
-x 4 root rood 
•x 4 root rood 
-x 4 root rood 
•x4 root rooti 
•x 4 root rood 
•x 4 root rood 
•x 4 root rood 
•x 4 root rood 
-x 4 root roofl 
-x 4 root rood 
-x4 rootrooi 
-x 4 root rood 
-x 4 root rool 
-x4 rootrooi 
-x 4 root rool 



lan 



ayli 20091 
ayl!2009| 
ayll2009| 
ay 11 20091 
ayll2009l 
ay 11 20091 
ay 11 20091 
ayll2009| 
18 1639 
unll201o[ 
ov4 20i0| 
lay 14 201: 
ct 19 2010 
"an 4 2335 
ay 11 20091 
,layll 2009| 
ay 13 20K 
ep20 20101 
/lay 11 2009| 
ug3i 02? 
ep 27 10:. 
ay 11 200$ 
ay 11 200$ 
ay 11 200$ 
4ayll 200$ 
lay 11 200$ 
Mg 26 20101 
ay 1 1 200$ 
ay 11 200$ 
ay 11 200$ 

r iin5 2009f 
day 1 1 200$ 
eb 11 203 
Ugll 02? 
eb 25 201 : 
ay 11 200$ 
ay 11 200$ 
ay 11 200< 
ul2120i: 
an 13 09: 
day 11 200$ 
ov26 16:- 
ayli 200$ 
iy 11 200$ 
ay 11 200$ 
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10500f 74 



8/13/13 

drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drvvxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
dnvxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr* 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
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xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XT- 
XI'- 
XT 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
XT- 
XT- 
xr- 
•xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XT- 

xr- 
xr- 
xr- 
•xr- 
•xr- 
xr- 
xr- 
•xr- 



x 4 root rootl 
x 4 root rootl 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root root 
x 4 root rootl 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
•x 4 root rood 
x 4 root rood 
•x 4 root rood 
x 4 root rood 
x 4 root rood 
x 4 root rood 
•x 4 root rood 
x 4 root roof 
-x 4 root rood 
•x 4 root rood 
x 4 root rootl 
•x 4 root rood 
-x 4 root rood 
-x 4 root rood 
•x 4 root rood 
•X 4 root rood 
-x 4 root rood 
•x 4 root rood 
•x 4 root rood 
•x 4 root rood 
-x 4 root rood 
•x 4 root rood 
-x 4 root rood 
•x 4 root rood 
•x 4 root rood 
-x 4 root rood 
-x4rootroo1 



lay 11 2005 
M 24 20091 
>ep 26 20:' 
Iun7 2010| 
)ec5 10:401 
Dct31 20:421 
Jov 13 20091 
lay 1 1 200S 
fvlay 1 1 200S 
Hay 11 200S 
|tfayll 200S 
lay 1 1 20C 
[ul30 20091 
|un28 201: 
lay 11 2005 
lay 1 1 2005 
Feb 8 201: 
lay 11 2005 
Way 11 2005 
lay 11 2005 
lay 11 2005 
lay 112005 
lay 11 2005 
7 eb7 20i: 
7 eb 8 201 
)ct 6 2005 
lay 14 2005 
^ay 1 1 2005 
lay 11 2005 
lay 11 2005 
v1ayll2005 
ay 1 1 2005 
I\pr21 201 
Pct5 10:42 
[ay 11 2005 
Jov 2 2009 
Jov 2 2009 
pec 9 09:40 1 
vlay 11 2005 
5ep 23 2009| 
Jov 15 201 ( 
lay 11 2005 
lay 11 200S 
7 eb 17 20101 
^ov30 2005 
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io5oir 4 



8/13/13 

drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
(3:13:31 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr* 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 



Case 1:1 2-cr-00185-LAP 

Conversation with yohoho@jabber.c 



Document 69-2 



Filed 04/16/14 Page 26 of 31 

) LeonQaudson@iabber.org /jabber.orq (jabber) 



xr-x 4 root root 
xr-x 4 root root 
xr-x 4 root root 
xr-x 4 root root 
xr-x 4 root root 
PM) yohoho@js| 
xr-x 98 root roc 
xr-x 9 root root I 
xr-x 3 root root I 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 9 root rootl 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 19 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
xr-x 5 root rootl 
xr-x 20 root roc 
•xr-x 20 root roc 
xr-x 20 root roc 
•xr-x 20 root roc 
xr-x 20 root roc 
xr-x 20 root roc 
•xr-x 20 root roc 
-xr-x 20 root roc 
•xr-x 20 root roc 



Lug 5 02:43 1 
jep 23 2010 
lay 11 2009J 
>ec 1 200S 
layU20( 
lcc.de: total 
Jan 9 1525 
|ep23 11: 
Up 23 11: 
Sep 23 20? 
Sep 23 20> 
Sep 23 20* 
Sep 23 20> 
Sep 23 20:< 
Sep 23 20:; 
Sep 23 20:: 
Sep 23 20;: 
Sep 23 20:: 
Sep 27 l: 
Sep 23 21: 
Sep 23 21: 
Sep 23 2] 
Sep23 2J 
Sep 23 21: 
Sep 23 21: 
lep23 11: 
Sep 23 21: 
Sep 23 21: 
Oct 28 06: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 11: 
Sep 23 21: 
Sep 23 21: 
Sep 23 23 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
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10501? 74 



8/13/13 

drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr* 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr* 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr- 
drwxr 
drwxr- 
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xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

XI- 

xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
•xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 
xr- 

■XI"- 

•xr- 
•xr- 

•XI'- 

•xr- 

•XT- 

•xr- 
•xr- 
-xr- 
•xr- 
•xr- 
-xr 
-xr 
-xr- 
-xr- 
-xr- 
-xr- 
-xr- 



x 20 root roc 
x 20 root roc 
x 20 root roc 
x 20 root roc 
x 20 root roc 
x21 root roc 
x 20 root roc 
X 20 root roc 
x 20 root roc 
x20 root roc 
x 20 root roc 
•x 20 root rocj 
x 20 root roc 
x 20 root rod 
x 20 root roo 
X 20 root roo 
x 20 root roo 
■x 20 root roo 
■x 20 root roo 
•x 20 root roo 
•x 20 root roo 
•x 19 root ro J 
■x 20 root roc 
•x 20 root roc 
•x 20 root rod 
-x 20 root xoi 
■X 20 root rod 
-x 20 root rod 
-x 20 root rod 
-x 20 root rod 
•x 20 root rod 
•x 20 root rod 
•x 20 root rod 
-x 20 root rod 
•x 20 root rod 
-x 20 root rod 
-x 20 root rod 
-x 20 root rod 
-x 20 root rod 
-x20 root rod 
-x 19 root rod 
-x 20 root rod 
-x 20 root roJ 
-x 20 root vo\ 
-x 20 root vol 



Sep 23 21 3| 

Sep 23 21:2 
Sep 23 21: 
Sep 23 21; 
Sep 23 21: 
Oct 3 123:1 
I Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
| Sep 23 21: 
Sep 23 21; 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 21: 
Sep 23 22: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Jan 9 15251 
Sep 23 23 2| 
Sep 23 23; 
Sep 23 23 r 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23:: 
Sep 23 23} 
Sep 23 23:- 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23? 
Dec 1 09:0? 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
Sep 23 23: 
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drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
drwxr-xr-x 
(3:13:53 PM) 
(3:14:12 PM) 
(3:14:24 PM) 
(3:19:23 PM) 
(3:19:36 PM) 
(3:20:09 PM) 
(3:20:11PM) 
(3:20:25 PM) 
(3:20:27 PM) 
(3:20:34 PM) 
(3:20:39 PM) 
(3:20:54 PM) 
V2 
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Comer sation vath y ohohc@jabber.ccc.de at 1/23/2012 12;50;07 PM on LeaiDawdson@iaW)er.org/jatto'-org (jabber) 

20 root root! Sep 23 23:50| 
20 root rootl Bep 23 23:50 
20 root root! Bep 23 23:54 
20 root rootl Rep 23 2354 
20 root rootl Bep 23 23:54 
20 rootroot^^Rep 23 2355 
20 root moil Rep 23 23:56 
20 root rootl Bep 23 23:58 
20 root rootl Bep 23 23:58 
20 root rootl Bep 23 23:59 
20 root rootl Bep 23 23:59 
20 root rootl Bep 23 23:59 
20 root rool Bep 24 00:00 
20 root roo | (ep 24 00:00^ 
le oiidavicSs on@^bber.org/jabber-org: nic^Uo^fl 
yohoho@jabber.ccc.de: yeah only the one| |iho 
Ieojndavidson@jabbenoig/jabber.oi^: shame, thatj 
yohoho@jabber.ccc.de: ok you ready for^ 
©r. 





i@ja 

yohoho@jabber.ccc.de : vesj 
yohoho@jabbcr.ccc.de :| 
yohoho@jabher.ccc.de 
yohoho@jabber.ccc.de : 
yoholio@jabber.ccc.de: then ./core 
Jioi2Jabher.ccc.de : mail is in \ 




lis nice, mad 



:et? 



what was ur 1 to that new list you needed cracked? 




root 

I am dumping all mysq! dbs to 



(3:21:21 PM) le ondavlds on@ jahbe r.org/jabbe r.org: got you 
(3:2i:26PM) leo0^vidson@jabber.org/jabber.oi^: working on 
(3:21:33 PM) yohoho@jabber.ccc.de: great 
(3:2l:47PM) yohoho@jabber.ccc.de: and (ten 
for now 

(3:27:23 PM) yohoho@jabber-ccc.de: drwxr-xr-x 1 1 root 



w 



drwxr-xr-x 9 root roo 
drwxr-xr-x 5 root roo 
drwxr-xr-x 14 rootro 
drwxr-xr-x 13 rootro 
drwxr-xr-x 1 1 root ro 
drwxr-xr-x 2 1 root ro> 
drwxr-xr-x 12 rootro 
drwxr-xr-x 1 1 root ro 
drwxr-xr-x 1 1 root ro 
drwxr-xr-x 13 root ro 




ec 17 2010 
ec 17 2010 
Jan 2 2011 
Dec 18 2010 
Jul 20 2011 
Oct 11 18:34 
Oct 11 13:5. 
Jul 20 2011 
Apr 19 2011 
Dec 18 2010 



(3:31:24 PM) yohoho@jabber.ccc.de: and then 




lis the best I can do on that windows target 



Jan 2 2011 
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8/13/13 Conversation with yohoho @jabber.ccc.de at 1/2^2012 12:50:07 PM on Leon Da\teon@jabbef.org/jabber.org (jabber) 

(3:31:33 PM) yohoho@jabbenccc.de :| 
(3:3l:37PM) yohoho@jabber.ccc.de: 
(3:3l:38PM) yohoho@jabber.ccc.de: have fon^) 
(3:3 i :46PM) Ieo«davidsoii@jabber.oi^/jabber.org: aRF 
(3:32:04 PM) leondavidson@jabber.o^/jabber.o^: finding new juicy targets bit 
(3:32:43 PM) 1eondavidson@jabber.org/jabber*org: paste me iirl for shell and backdoor for that ^j mc 
(3:32:48 PM) le onda vids OR@ja bbe r.o rg/jabbe r.org : it has gov^on it right? 
(3:32:51 PM) IeondavE<boD@jabber.org/jabber.org: the non- windows one 
(3:32:59 PM) yohoho@jabber.ccc.de :_ok 
(3:33:05 PM) yohoho@jabber.ccc.de: 
(3:33:17 PM) yohoho@jabber.ccc.de: 
(3:33:24 PM) yohoho@jabber.ccc.de: other hosts ia 
(3:33:24 PM) ie onda vids on@ fa bbe no ra/tobhe r. 
(3:33:52 PM) yohoho@jabber.ccc.de: 
(3:4734 PM) Ieondavidson@jabber.org/jaDDer. v . ,, 
(3:47:43 PM) teondavidson@jabber.ot^/jabbcr.org 
(3:47:48 PM) leondavidson^jaHber.org/jabber.org 
(3:47:50 PM.) !eondavidson@jabber.org/jabber*ot^ 
(3:47:52 PM) teondavidson@ jabber. 
(3:47:53 PM) leondavidson@ jabber* 
(3:47:54 PM) yohoho@jabber.ccc.de: crazy 

(3:48:05 PM) leondavldson@jabber.oi^/jabber.org; they've been tatting eveiyth^ 
(3:56:39 PM) kondavidson@jabbcr.orgZjabber.org: interesting bro 
(3:56:48 PM) Ieondavidson@jabber,Grg/jabber. 
(3:56:54 PM) leond^vidson@jabber.org/jabber t ox^: nanningplesk 
(3:57:49 PM) yohoho@jabber.ccc.de: =) rooting 
(3:58:01 PM) Ieo»davidson@jabber.or|^jabber.org; kk 
(3:5821 PM) leondavfdsoR@jabber.or^jabber.org: backdoor 
(3:58:32 PM) yohoho@jabber.ccc.de: for real 
(3:58:33 PM) leoRdavkfeon@jabber.org/jabber.oi^: we'll be in every big network 

(3:58:45 PM) Ieondavids0n@j&bber.org/jabber.org: but its windows based, so we need a undetectable packer 
(3:58:46 PM) yohoho@jabber.ccc.de: wed alive to do some advanced mahvare 
(3:58:49 PM) teondavidson@jabber.oi > g/jabber.ot^: yup 
(4:00:03 PM) yohoho@jabber.ccc.de: ok well 

(4:00:15 PM) yohoho@jabber.ccc.de: having trouble uploading shit to it, but, got M the passes 
i yohoho 



shits popping 

where all tht 
smashing o 
come check this out 
ROFL 




r admin password 

er #ataque on anonops 
dosers are together 




hosts projects like 



>wn thousands of network admins 



te 
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8/13/13 Conversation with >oh(^o@jabber .ccc.de at 1/23/2012 12:50:07 PM on LeonDavid5on@jabber.org^abb^r.org (jabber) 

ut^redictabWuntrustworthy 

(5:10:47 PM) leondavidss>n@jabber-os , g/jabber.oi^: yeah but you know my brother, whats going to have to 

happen with wikileaks if it wants to exist past julian assange 

(5:10:52 PM) leondavidsott@jabber.org/jabber«org: is to decentralize itself 

(5:11:01 PM) teondavidson@jablier.org/jabber*o^g: it'll become another anonymous 

(5:ll:09PM) leondavidson@jab!ier.oi%/|abber.org: with the basis of leaks and hackers 

(5:11:11 PM) yohoho@jabber.ccc.de: oh I agree 

(5.1 1 :22 PM) yohoho@jabber.ccc.de: we've kind of already fulfilled the fitncitonality of WL in some regards 

(5:li:29PM) yohoho@jabber.ccc.de: whenw e dump all the emails on ow onions/torrents etc 

(5:11:31 PM) yohoho@jabber.ccc.de: it's no different 

(5:1 1:33 PM) leofidavidson@jabber.org/|abber.oi^: jea 

(5:ll:40PM) yohoho@jabber.ccc.de: however as far as JA is concerned 

(5:1 1:45 PM) yohoho@jabber.ccc.de : there is risk for them to work wilh us 

(5:ll:54PM) yohoho@jabber.ccc.de: they were akeady half assedly blamed for this stratfor ahck 

(5:12:04 PM) yohoho@jabber.ccc.de: they could have just been like fuck it why would we incriminate ourselves 

(5:12:15 PM) yohoho@jabber.ccc.de: so it's good that they are taking an opportunity to work with 'rogues' Hke 

us 

(5:12:20 PM) yohoho@jabber.ccc.de: it could be mutually beneficial 
(5:12:38PM) Ieondavid$on@jabber.org/jabber.org: ind33d 

(5:12:44 PM) yohoho@jabber.ccc.de: as far as early leaks of the emails go, well, they are supposedly 'building a 
coalition' 

(5:12:47 PM) yohoho@jabber.ccc.de: of orgs, journalists 

(5:13:15 PM) yohoho@jabber.ccc.de: who if they are to ivnest time/resources into this project with WL, 
probably don't want to see rogue elements prereleasing shit 
(5:13:16 PM) yohoho@jabber.ccc.de: etc 

(5:14:14 PM) yohoho@jabber.ccc.de: however JA himself agreed ahead of time that we should be dumping 
some of them 

(5:L4:2i PM) Ieoir?dav{dsoR@jabbenorg/jabber.os^: mhm 
(5:14:45 PM) yohoho@jabber.ccc.de: to put them on the defensive 
(5:14:49 PM) yohoho@jabber.ccc.de: which I think it def did 

(5:15:02 PM) yohoho@jabber.ccc.de: it really made them look like assholes, deserving of getting hit 
(5:15:11 PM) yohoho@jabber.ccc.de: shit if we had that occupy statement by the stime of the defacement 
everyone would have hated them 
(5:16:45 PM) leondavidson(£;iabber.oiw'}abber,org ; true 

(5:24:41 PM) teondavidson@jabber.org/jabbenoE^| J-'ou have that? 

(5:25:58 PM) yohoho@jabber.ccc.de: is restricted in accordance with W AcggSS restriction policy currently 

applied. 

(5:26:00 PM) yohoho@jabber.ccc.de: oh well 

(5:26:16 PM) lcondavid$on@jabber*org/jabber.org: ;] 

(5:31:09 PM) yohoho@jabber.ccc.de: keep them coming though 

(5:31:17PM) yohoho@jabber.ccc.de: usually have -50% success rate 

(5:35: 1.6PM) teondavidson@ jabber.org/jabber.org: yup _ 
(5:39:10PM) leondavidson@jabber.o'rg^abbenorg: | |get that, looks like it might controiHld 

(5:42:06 PM) yohoho@jabber.ccc.de: k def ownabte 
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8/13/13 Convsrsation vwlh y3hoho@jabber^^ (jabber) 

(5:42:22 PM) yQhoho@jabber.ccc.de ^B^^^^^^^^^^^B 




lesk. creates fOemaker databases for 



(5:42:23 PM) yohoho@jabber.ccc.de: niiice. 

(5:42:28 PM) yohoho@jabber.ccc.de: I love a lot ofmaiL 

(5:42:42 PM) kondavidson@jabber.org/jabber B o!"g: :) 

(5:43:19 PM) yohoho@jabber.ccc.de: you want to get to work on this one? 

(5:43:21 PM) yohoho@jabber.ccc.de : kinda in the middle of soroethin 

(5:44:50 PM) leondavsdson@jabber.org/jabber.org: upoad xml/sql shit to the server 

(5:45:08 PM) leoiidavidson@jabber-org/jabbeHGi^: if this is tied to the tkJ that'll be nice, if not well fuck it its 

another box for u 

(5:45:10 PM) Ieondavtdson@jabber.org/jabber.org: us 

(5:51:45 PM) leoEKlavidson@fibber.org/jabber»org: LoD requested we look into:^M^^Bdoesn f t run piesk. 
but if we can own it that'llbenefit them I guess they want the db 
(5:52:26 PM) yohoho@jabber.ccc.de: k 

(5:58:37 PM) Ieonda\idson@jabber.org/jabber.Grg: . 
wall street journal, etc. might be interesting 
(6:01:40 PM) yohoho@jabbcr.ccc.de: rooting innerflle now 
(6:02:59 PM) yohoho@jabber.ccc.de: done 
(6:03:02 PM) yohoho@jabber.ccc.de: man this shit is too easy 

(6:03:30PM) yohoho@jabber.ccc.de: we need people to do nothing but search for great plesk targets 
(6:05:38 PM) Ieondavidson@jabbe r.org/jabber.org: yup 
(6:08:38 PM) yohoho@jabbe r.cccde: hrm they disable pbp exec 
(6:08:40 PM) yohoho@jabber.ccc.de: so no webshell 
(6:08:41 PM) yoboho@jabber.ccc.de: on cp 

(6:08:48 PM) yohoho@jabbe r.cccde : but I can spawn a reverse shell for you now if you want 
(6:09:03 PM) yohoho@jabber.ccc.de: or you can do this from a bouncebox 

(6:09:10 PM) Ieojndavldso?i@jabber.org/jabber.oi'g: put it to the side for now just document the target and we'll 
play wih it later 

(6:09:13 PM) teondavidson@jflbber.org/iabber.org: its kktaof bw level 
(609: 1 7 PM) y ohoho@jabbe r.cccde j 
(6:10:09 PM) leondavid$on@jabt 

(6:10:17 PM) jeondav1dson@jabber.org/jabbcr.org: oh sweet 
(6:10:58 PM) leondavidson@jabber.org/jabber.org 

(6: 1 1 :24 PM) leonda vids on@ja bbe norg/jabbenorg: looking for erribassys and consulates 
(6:ll:37PM) yohoho@jabber.ccc.de: back 



t sure which embassy is this or 




gets now 
jM play with that in a few ;) 



(6:12:27 PM) Ied!Kfavus$on(#^ 
(6:12:48 PM) Ieondavid$on(< 
just the domain 

(6:13:03 PM) yohoho@jabber.ccc.de | 
pohohoti 




I rooted 




(6:13:41PM) yohoho@jabber.ccc.de: wait 
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8/1 3/13 Conversation with >ohoho@abber, ccc.de al 1/23/2012 12:50:07 PM on Lecr©awdso!T@|abber.org/jabber.org (jaboer) 

(6;i3:42PM) yohoho@jabber.ccc.de: for real? 
(6:14:ii PM) yohoho@jabber.ccc.de: rooted 
(6:14:48 PM) leondavidson@jabber.ois/jabber*oi^: 
(6:14:54 PM) koiidavidson@jablMir.oi^/jabbenor§| 
(6:15:02 PM) leondavidsoni^jabber.org/ja 1 
(6:15:21 PM) yohoho@jabber.ccc.de: btw 
(6:15:23 PM) yohoho@jabber.ccc.de: eveiytime I say it's rooted 
(6: i5:32PM) yohoho@jabber.ccc.de: that means that ctrLphp is now installed 
(6:15:37 PM) yohoho@jabber.ccc.de: as well as sukl root backdooor 

(6:15:49 PM) yohoho@jabber.ccc.de: so then you can do that curl command to execute commands on everyone 
IVe said so far 

(6:15:51PM) yohoho@jabber.ccc.de: ifyouwantto get to work 
(6:15:53 PM) leondavidson@jabber.oig/jabbenorg: got you 
(6:16:19 PM) yohoho@jabber.ccc.de J |» rooted 

(6:16:20PM) yohoho@jabber.ccc.de: bl 
(6:16:23 PM) yohoho@jabber.ccc.de: too easy man 
(6:16:26 PM) yohoho@jabberxcc.de: so many roote d targets 
(6: 17:35 PM) Ie« 
for a db of phone numbers 
(6:18:21 PM) Ieondavidson@jabfcer.< 
(6:20:01 PM) leondavi&sonj® jabbcr.oi 
bail bonds 

(6:21:28 PM) leoadavidsojn@jabber.ojE^/jabber,oJcg^ 

(6:22:29 PM) yohoho@jabber.ccc.de: I have mixed feelings about bail bondsman 
(6:22:37 PM) yohoho@jabber.ccc.de: on one hand they help people get out 
(6:22:41 PM) yohoho@jabber.ccc.de: but in ihe end people end up paying boatloads of cash 
(6:22:44 PM) yohoho@jabber.ccc.de: fd rather hit debt collectors 
(6:22:48 PM) Ieondavidson@jabber.org/jabber.ot$: got you 

r??. pvn leondavidsorafeiabber.org/iabber.ore: 22:19 <SnSk3Kx> RT please 





'uflc sms sender, might be able to use this 



ese niggas doing 



another bail bonds 




22:20 <Splk3Ex> my group have 200GB link to DDoS 
2220 <Splk3Ex> ifyou need help just ask 



(6:35:29 PM) leondavidson@jabber.org/jabber.os^: they just dropped 
(6:35:57 PM) yohoho@jabber.ccc.de: shit's on fire 
(6:36:35 PM) leoiidavidson@jabbenorg/jabbeno!^ 
(6:39:09 PM) Ieondavidson@jabber.org/jabber.oig| 
(6:39:10 PM) leonda vicfe; oft@jabbe r.org/jabber.org: win 
(6:4035 PM) teondavidson@jabber*o: 

(6:4l :54PM) yohoho@jabber.ccc.de: I (owned =) 

(6:44:00 PM ) le onda vtds on@ jabbe r.org/jabbe r.org : 
page and jquerytools developers ^^^^^^^^ 

(6:44:57 PM) yohoho@jabber.ccc.de :■ Irooted 
(6:45:02 PM) yohoho@jabber.ccc.de: j^^xS^rStes right? 
(6:45:05 PM) leondavidson@jabber.org^jabber.org: ja 




iggest bank 





layer project 



fiie:///CJljog Files July 201 1 to March ;&12i3abber/jat^ 



10503tf' 



Case 1 :1 2-cr-001 85-LAP Document 69-3 Filed 04/1 6/1 4 Page 2 of 31 

8/13/13 Conversation wth $ohDho@jabber .ccc.de at 1/23/2012 12:50:07 PM on LeonDa^dson@]abber.org/jabber.org (jabber) 

(8:38:27 PM) Ieondavidson@jabber,org/bc59730el1 5dfd3d: for the 



(8:39:53 PM) 
(8:39:55 PM) 
(8:39:57 PM) 
(8:40:00 PM) 
(8:45:13 PM) 
(8:45:16 PM) 
(8:45:22 PM) 
(8:45:23 PM) 
(8:45:35 PM) 
(8:45:43 PM) 
logs 

8:58:40 PM) 
(8:58:44 PM) 
S:59:27 PMl 



yohoho@jabber.ccc.de: microsoft mdb 
yohoho@jabber.ccc.de: cant be done ==( 
yohoho@jabber.ccc.de: others? 

le ondavids on@jabbe r.org/bc59730e 1 15dfd3 d: working on it 
te oxida vids o n@ ja bbe no rg/hc59730e 1 15dfd3 d: apparently 
Icojadavidson@jabber*org/bc59730el1.5dfd3d; m nerva's been around 
yohoho@jabber.ccc.de : fatrra? 
yohoho@jabber.ccc.de: stilt? 

!eondavidson@ jabber.org/bc59730el ISdfcBd: yup. Vm about to confront his snitch ass 

m@ jabber.org/bc59730e 1 15dfd3d: he got lyan clearly raided, and leaked those #pe 



ISdfjjBd: off shore domain name proxy 




(8:59:57 PM) 
(9:00:57 PM) 
(9:01:51 PM) 
developer 

(9:02:31PM) 
(9:18:10 PM) 
(9:18:16 PM) 
(9:18:18 PM) 
(9:1.8:29 PM) 
(9:18:52 PM) 
(9:19:08 PM) 
(9:19:10 PM) 
(9: 19:12 PM) 
(9:19:13 PM) 
(9:19:19 PM) 
(9: 19:20 PM) 
(9:19:21PM) 
(9:19:29 PM) 
(9:19:29 PM) 
(9:19:50 PM) 
(9:20:00 PM) 
(9:20:10 PM) 
(9:28:32 PM) 
(9:29:35 PM) 
(9:29:56 PM) 



yohoho@jabber.ccc.de : rooted 



norg/bcwMUej 
r.org/bc5973Gel 



S: sex 




cad software 





yohoho@jabber.ccc.de: bldude 
Ieo11davfdson@jabber.or5j 
yohoho@jabbenccc.de: | 

ieondavidson@jabber.org/bcS9730ell5dftl3d: thefiick is that 
yohoho@jabber.ccc.de: it's rooted that's what -) 
ie ondavidson(£; ia bbe r. t 

gondavitisonfjfgj 
leondavidson@jabber.org/beS9730e 1 1 Sdfd3d: hit that up 
Ieondavldson@jabber.org/bc59730ell5dfd3d: for my ppl 
yohoho@jabber.ccc.de: they have a pro-fbi article about megaupload up 
yohoho@jabber.ccc.de: k 

yohoho@jabber.ccc.de: fm gonna focus on this .gov tho 
!e onda v Ids on@jabbe r. org/bc59730e 11 S df d3d: really? 
ieondavid$on@jabber.oi , g/bc59730el ISctfdBd: nice 
yohoho@jabber.ccc.de: sorry no on that | 

Ieondavid$on@jabber.org/bc59730el ISdfdBd: kk I'D just gather targets you work on the gov 
yohoho@jabberxcc.de: k 

Ieondavidson@jabbenorg/jabbenorg: feggot ass internet 

yohoho@jabber.ccc.de: you think you ce 

leondavidsonC^bbenors/jabbenorg: I Bbig target) 



(9:30:03 PM) ie ond a v ids on@ jabber.org/jabber.org: yes what you need done niglet 
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(9:30:08 
(9:30:21 
(9:30:21 
(9:30:22 
(9:30:28 
(9:30:37 
(9:30:48 
(9:30:53 
(9:31:02 
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Conversation with y3hoho@jabber.ccc.de at 1/23/20 12 12:50:07 PM on LeonDavidson@iaW)er.org/i«a*er.orfl flabber) 

PM) yohoho@jabber.ccc.de: hmactuattjj^s n ot a .gov 
PM) yohoho@jabber.ccc.de: scan subnet around | 
PM) yohoho@jabber.ccc.de: because they are aflplesk 
PM) yohoho@jabber.ccc.de: and| |is a gov 

PM) Ieoiidavidsoii@jabber.org/jabber.oi^: eh? 
PM) leondavid$on@jabbenot$/jabber.org: k 

PM) Seof!davidson@jabber.org/jabber.org: try to hit that first one if possible 
PM) !e ogidavidson(^!itbhe?;o r^jabber.org: I'll scan these gay ass nigs 
ohohofi 






;est media eomany 



company 



(9:3l:03PM) yohoho@jabber.ccc.de: niiij 
(9:31:03 PM) yohoho@jabber.ccc.de: o 
(9:3 1 :10 PM) leondavidson@ jabber.org/jabber.org 
(9:31:13 PM) ieondavidsoii@jabber.o 
(9:32:00 PM) leondav 
(9:32:0.1 PM) leoadav 

(9:32:10PM) yohoho@jabber.ccc.de: ok 
(9:32:11 PM) yohoho@jabberxcc.de: well 

(9:32:17 PM) yohoho@jabbenccc.de : it's having troubles getting the backdoors up 
(9:32:19 PM) yohoho@jahber.cce,de: but I can get passies 
(9:32:22 PM) Ieondavidboii@jabber.org/jabber.ots: pasies are fine 
(9:33:20PM) yohoho@jabber.ccc.de: copying to our priv8 
(9:33:27 PM) leondavidson@jabber*org/jabber*org: kk 
(9:34:07 PM) yohoho@jabber.ccc.de: | 
(9:34:08 PM) yohoho@jabbenccc.de: it's up 
(9 34:1 1 PM) yohoho@jabber.ccc.de : GO ! ! ! ! ! !<3<3 
(9:34:13 PM) leondavidson@jabbenorg/jabber.org: <3 
(9:34:14PM) leoiuiavidsoii@ jabber.org/jabbenofg: loveu 
(9:50:53 PM) leondavidson@jabbenorg/jabbenorg: yo nigga 
(9:50:54 PM) 1eondavidson@jabbenoi£/jabber.org: you there? 
(9:51:05 PM) yohoho@jabbenccc.de: you get anywhere wiflithat? 
(9:51:06 PM) yohoho@jabbenccc.de: yes 

(9:51:19 PM) leondavidsoji@jabbenorg/jabber.org: someone just owned 
make tear gas for military 
(9:51:41 PM) yohoho@jabbenccc.de: yes 

(9:5 1 :50 PM) yohoho@jabbenccc.de: I been eyeying that target for a very longtime 
(9:5l:52PM) yohoho@jabbenccc.de: it's running plesk 

(9:5l:56PM) Ieondavidsoii@jabbenoi^/jabbenorg: hes giving us php shell its as fer as he can get 

(9:51:57 PM) yohoho@jabbenccc.de: I have mad dox on them too 

(9:5l:57PM) leondavidson@jabbenoi^jabbenorg: with it 

(9:52:01 PM) leondavidsoii@|aWienoig/jabbeno^: can't root it 

(9:52:03 PM) yohoho@jabbenccc.de: yes that would be great 

(9:52:03 PM) leondavldsoa@jabbenoi , g/;iabber n org: needs us to finish it 



the guys that 
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(9:52:05 PM) 
(9:52:10 PM) 
(9:52:11 PM) 
(9:52:12 PM) 
(9:52:25 PM) 
(9:52:26 PM) 
(9:52:35 PM) 
(9:52:40 PM) 
(9:52:42 PM) 
(9:52:46 PM) 
(9:52:47 PM) 
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Conversation with iOhoho@jabber.ccc.de at 1/23/2012 12:50:07 PM on LeonDavidson@iabber.org/jabber.org (jabber) 

Ieond^vid$on@jabber.org/jabber.ov^: kk 



org/jahher.org: one minute 
yohoho@jabber.ccc.de: well 
yohoho@jabber.ccc.de: it's windows 
yohoho@jabber.ccc.de: =) 

yohoho@jabber.ccc.de: a new local root exploit came out a few days ago 
leondavid$on@Jabber.org/jabber.org: he has one condition 

leondavidson@jabbenoi^/jabber.org: you deiace it on the 1 year aniversary of arab spring 
SeondavidS5>n@ja.bber.oi^/jabber.org: which i think is next week? 
yohoho@jabber.ccc.de: sure when's that? 
yohoho@jabber.ccc.de: oh, shit homey 
yohoho@jabber.ccc.de: that's soon 

<E 




01:42 <Exu> websbell 



(9:53:15 PM) leondavidsoBi@jabbenorg/jabber.org: ckeditor ... LOL 
(9:53:37 PM) yoholw@jabbei%ccc.de : I can't wait to dig into that target 

(9:53:38 PM) lei 
01:43 <Exu>[ 





(9:53:48 PM) leondavid$oii@} 
01 :43 <Exu> open shell to po: 

(9:53:57 PM) leondavid$on@jabber.o^jabbenorg: 01:43 <Exu> bind 
01;43 <Exu> no firewall 



(9:54:11 PM) leondavidson@jabbenorg/jabber.arg: 01:44 <Exu> linux 2.6.20 



(9:54: 14 PM) 
(9:54:15 PM) 
(9:54:28 PM) 
(9:54:36 PM) 
(9:54:39 PM) 
(9:54:52 PM) 
(9:55:28 PM) 
(9:55:29 PM) 
(9:55:30 PM) 
(9:56:57 PM) 
if you want 
(9:57:41 PM) 
(9:57:49 PM) 
(9:58: 14 PM) 
(9:58:16 PM) 
(9:58:22 PM) 



r.org: son 

yohoho@jabber.ccc.de: well wait a minute 
leonc!a,vhfeon@jabber.org/jabber.org: yeah? 
yohoho@jabber.ccc.de: hrm when I looked at this it was windows 
yohoho@jabber.ccc.de: but ill see 

Ieondavid$on@jabbenorg/jabber.o^: probably their web server was switched to a linux box 
idsoi^jabber.org/jabber.org: yeah bro this is the real deal 
dson@ jabber.org/jahber.org: linux box 

son@jabbenorg/jabber.org: gentoo shit 
d$on@jabber.org/jabber.org: ok he said instead of defacing it next week you can sit on it 



seondav 



yohoho@jabber.ccc.tle: priority is mail obv 
norg/jabber.org 
norg/jabbenorg 
yohoho@jabber.ccc.de: bl 

yohoho@jabber.ccc.de: I saw this exact webshell a few days ago 




(handles its mail 
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8-13/1 3 Conversation with >ohoho@j abberxcc.de at 1/23/2012 1£50:07 PM on LeonDavidsort@jabber.org/jabb«--org (jabber) 

(9:58:27 PM) yohoho@jabber.ccc.de : that dvO had 

(9:58:40 PM) leofidav]dson@jabbenorg/jabbenorg: he says in the I llicrcs email logins that need 

cracked 

(9:59:13 PM) leondavidsoo@jabbenorg/js8bhenorg: once cracked they can probably be used to bg into mail 

server to dump mails 

(9:59:31 PM) yohoho@jabber.ccc.dte: yes 

(10:01:05 PM) Ieo!idavIdson@jabber.org/jabl^r.or^: 01:49 <Exu> if someone crack the hash tell me ... ihave 
some tool to investigate quickly through webmails ( gmail, yahoo,... ) 
01 :50 <Exu> the DB is small 

01 :50 <Exu> bul these guy may have receive someintresting emailz 
01 50 <Exu> i let you do deface and press release 



(10:01:16 PM.) 
(10:01:31 PM) 
(10:01:41 PM) 
(10:01:50 PM) 
(10:03:14 PM) 
(10:03:17 PM) 
(10:03:22 PM) 
(1.0:03:40 PM) 
(10:03:43 FM) 
(10:03:50 PM) 
(10:03:51 PM) 



vidson@jabber.org/jabber-org: hes a security researcher 
yohoho@jabber.ccc.de: awesome 

leondavidson@jabbenorg/j^bber.ot^: im going to put him through some tests 
ieondavidson@jabS>er.O!^/jabb€r.o3^: see if hes a future recruit 
yohoho@jabber.ccc.de: god has been owning lots of shit too 
yohoho@jabber.ccc.de: hes kinda newb tho 
yohoho@jabber.ccc.de: but if he's putting in work it's potential 
leondavidson@jabber,org/jabber.org: god is too newb honestly hes reckless 
leondavidson@jabbenorg/jabber.org: he sent me a picture of his setup 
leondavtdson@jabber,©rg/jabber.org: its basically him. m his room with a fucking cantenna 
e o nda vidson@jabbe r.o rg/iabbe r.org: LOL 




|— when you're free 
(10:09:00 PM) yohoho@jabber.ccc.de: damn you 

(10:09:08 PM) yohoho@jabber.ccc.de: I was thinkin maybe I could deface this .gov tonight hah 
(10:09:10 PM) yohoho@jabber.ccc.de: for optnegaupload 
(10-09:11 PM) Ieondavidson@jabhenorg/lc2bb44dd636787e: 1:58 <Exu> and 
01 :58 <Exu> [database] ( 
01 :58<Exu> database 
01:58<Exu>user = | 
01 :58 <Exu> password - 1 
for 

(10:09:15 PM) vohoho^iabber.ccc.dd 




(10:09:23 PM) ieondavidsosi@jabbenorg/ic2bb44dd636787e: so mafoy 
(10:09:48 PM) Ieondavidson@jabber.org/lc2bb44dd636787e: another: 
(10:13:47 PM) yohoho@jabber.ccc.de: mysq> select * from users; 
+ -f- -f 

—4- 4- -K +~ + +• 
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8/13/13 Conversation wlh y3hoho@jabber.ccc.de at 1^2012 12:50:07 PM on LeonDawdson@jabber.orgyjabber.org (jabber) 

-4* 4- — 4-- 4-- 

- + 

| uid j name | pass | mail | theme j signature j sjgoaturejfbrmat j created | access | fogin j status | timezone ] 
language j picture | init | data j 

4- +~ + + 

-+ 4- 4-- 4- 



4- 
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Conversation with y3hoho@jabbef.ccc.da at 1/23.&Q12 12:50:07 PM on LeonDavicison@iat^)er.QrQ/iabtier,Qrg (jabber) 



— +~ + -h + +- + + + 

-4- 4- + + 

+ 

18 rows in set (0.09 sec) 

(10:13:53 PM) yohoho@jabbcr.ccc.de: on that | Jsite 

(10:14:16 PM) teondavidson@jabber.oi^/l.c2bb44dd636787e^||H 

(10: 14:50 PM) leondavidson@jabbenoi^/lc2bb44dd<S36787e: adrnin@exampIexorn wow these guys re really 
new 

(10:14:58 PM) leo«davidson@ jabber.org/lc2bb44dd636787c : I'D see if my boy can crack these real quick 
(10:15:01 PM) yohoho@jabber.ccc.de: yeah some straight garbage 
(10:15:04 PM) yohoho@jabber.ccc.de: yeah try them 
(10:18:00 PM) yohoho@jabber.ccc.de: guap is windows so I'll get passies 
(30:18:27 PM) teondavidson@jabbcr,o rg/1c2bb44dd636787 e: kk 
(10:20:47 PM) yohoho@jabber.ccc.de : | 
(10:21:35 PM) yohoho@jabber.ccc.de: err^ 
(10:21:36 PM) yohoho@jabber.ccc.de: 

(10:22:24 PM) Ieondavidso»@jabber.oi^/lc2bb44dd636787e: thx love 
(10:29:06 PM) yohoho@jabber.ccc.de: none of those others worked 
(10:29:13 PM) teondavidson@,^bb&noi|E/lc2bb44dd636787e: gay 
(10:29:16 PM) leondavi€bon@jabbenorg/lc2bb44dd636787e: thanks though 
(10:41:05 PM) yohoho@jabber.ccc.de: your crackers online/ 
(10:4l:06PM) yohoho@jabber.ccc.de: ? 

(10:41:11 PM) yohoho@jabber.ccc.de: id like to take a bok at their mail 
(10:41:12 PM) yohoho@jabber.ccc.de: otherwise 
(10:41:15 PM) yohoho@jabber.ccc.de: we should just deface tonight 
(10:41:15 PM) leondavid^on@jabber*org/lc2bl>44dd636787e: hes idling like a nig 
(10:41:19 PM) yohoho@jabber.ccc.de: while opmegaupfoad is hot 
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Conversation with >ohoho@]0bber .ccc.de at 1/25/2012 4:34:03 PM on LeonDa^dson@jabber.org/jsbber.org (jabber) 



Conversation with yohoho@jabber.ccc.de at 1/25/2012 4:34:03 PM on 
LeonDavidson@jabber.org/jabber.org (jabber) 

(4:34:03 PM) yohoho@jabber.ccc.de: The encrypted message received fromyohoho@jabber.ccc.de is 
unreadable, as you are not currently communicating privately. 

(4:34:09 PM) The encrypted message received fromyohoho@jabber.ccc.de is unreadable, as you are not 
currently communicating privately. 

(4:34:12 PM) Unverified conversation with yohoho@jabber.ccc.de/ghost started. 
(4:34:1 8 PM) yohoho@jabber.ccc.de: [resent] do you have a way to gel. ahold of pOisanOn 
(4:35:14PM) ieondavidson@ja bber.org/jabher.org: yo! !!!!!! 
(4:35:16 PM) leondavidson@jabber.org/jabber.oi^: nigga 
(4:35:20 PM) leondavidson@.^ibbenoi^/jabber.org: sorry I passed out last night 
(4:3528 PM) yohoho@jabber.ccc.de: yoyo 
(4:35:31PM) yohoho@jabber.ccc.de: me too 
(43534 PM) vohoho@jabber.ccc.de: pOisanOn 

(4:35:38 PM) leondavMson@jabber.org/jabber.org: yes. he hangs out with cabincrew 
(4:35:39 PM) yohoho@jabber.ccc.de: know where he hangs out? 
(4:35:44 PM) yohoho@jabber.ccc.de: on ire? 
(4:35:45 PM) leondavidbon@jabber.org/jabber.org: yup 
(4:35:47 PM) !eondavidson@jabber.org/jabber.org: cryto 

(4:35:54 PM) leondavidson@,jabber.oi^/jabher.org: join cabincrew and speak to him there 
(4:35:57 PM) yohoho@jabber.ccc.de: invite supg 
(4:37:41 PM) !eondavid$on@jabber.org/jabber.org: kk 
(4:38:06 PM) yohoho@jabber.ccc.de: err nevermind 
(4:38:08 PM) yohoho@jabber.ccc.de: it was an0n4g 
(4:38:27 PM) leondavidson@jabber.org/jabber.oi'g: got you 
(4:38:31 PM) leondavidson@jabbenorg/jabbenorg: ready to get busy? 
(4:38:45 PM) yohoho@jabber.ccc.de: well 

(4:38:48 PM) yohoho@jabber.ccc.de: I have to do an hour or so of real work 
(4:39:14PM) yohoho@jabber.ccc.de: and aso anon4g, know how to get a hold ofthem? 
(4:40:40 PM) leondavidsois@jabber.oi^/jabber.oi^;: I'll reach out to him don't know ihm personnaBy 
(4:40:43 PM) leondavidsoB@jabber-org/jabber.org: why? they beefing ?? 

(4:40:53 PM) yohoho@jabber.ccc.de: no, but he's owning city hall fecebook profiles and shit 

(4:41:02 PM) yohoho@jabber.ccc.de: and ?d like to see what else he got 
(4:44:16 PM) leomkvidson@jabber.org/Jabber.org; got you 
(4:44:18 PM) kondavidson@jabber.org/jabber.org: Pll hit em up 
(4:44:23 PM) yohoho@jabber.ccc.de: nevermind 
(4:44:26 PM) yohoho@jabber.ccc.de: got him 
(4:44:46 PM) yohoho@jabber.ccc.de: still would like invite to cabir 
(4:45:38 PM) yohoho@jabber.ccc.de: also 1 dumnecUh^ipoo^ fi>r| 
(4:45:43 PM) yohoho@jabber.ccc.de: it's on the 1 ■thing 
(4:45 48 PM) yohoho@jabber.ccc.de : he's a former prosecuter 
(4:46:1 7 PM) lcondavUbon@jabber.oi^/jabber.OKg: kk read it in a sec 
(4:46:20 PM) leondavidso!i@jabber.org/jabber.org: III invite you in a minute 
(4:48:38 PM) Ieondavidson@jabber.oig/jabber.oi^: pop off 
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8/ia"13 CpiNemto onLec«Davldson@abber.orgj(iabber.org (jabber) 

(4:48:41 PM) : 






in bed wit govt) 
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8/13/13 Conversation with iOhoho@iabber.ccc.de al 1/25/2012 4:34:03 PM on LeonDavidsonfgiabber.org^abber.org Gibber) 



[ki bed with govt. 








slavery) 



(4:48:54 PM) yohoho@jabber.ccc.de: 
(4:48:56 PM) yohoho@jabber.ccc.de: 
(4:48:58 PM) yohoho@jabber.ccc.de: 
(4:49:01 PM) yohoho@jabber.ccc.de: 
(4:49:13 PM) yohoho@jabber.ccc.de: 
mirrored soemwhere before they rm 
(4:49:16 PM) leondavid$on@ jabber. 
(4:49:38 PM) feondavid$on@ jabber, 
thorough 

(4:49:39 PM.) leondavidson@ jabber. 
(4:49:51 PM) leontiavidsoii@jabber. 
hackers 

(4:49:58 PM) 
(4:50:04 PM) 
(4:50:16 PM) 
(4:50:22 PM) 
(4:50:24 PM) 
(4:50:30 PM) 
(4:50:31 PM) 
(4:50:31 PM) 
(4:50:32 PM) 
(4:50:35 PM) 
(4:50:36 PM) 
(4:50:37 PM) 

(4:50:38 PM) yohoho@jabber.ccc.de: 

(4:50:53 PM) 
(4:51:04 PM) 
(4:51:08 PM) 
(4:51:11 PM) 
(4:51:28 PM) 
(4:51:45 PM) 
(4:51:54 PM) 



omfg 
nice list 
but hey 

next time we pass targets off 

we have to make sure they at LEAST copy the tnail/dbs and have it 

org/jabher*oq»: invited 
g/jahber.org: yup thefls did impact, but I'll speak to havitja to be more 



will be handled RedHack lamousl 



org/jabber.org: nov^^^_ 
org/jabber.org: the II 



r. 

'j^jab&er.o 
yoholio@jabber.ccc.de : 
yohoho@jabber.ccc.de : 



er.org, 



yohoho@jabber.ccc.de: 
» yohoho@jabber.ccc«de: 



yohoho@jabberxcc.de : 

en 



leondavidson@jabbeno 
i yohoho@jabber.ccc.de: 



yohoho@jabber.ccc.de: 
yohoho@jabber.ccc.de: 



& : they have aBegience to us 
fg/jabber.org; by* 
oh hell yes redhack 
they are badass 
rg/jabbcr.org: yup 

g/ja bber.org: I will get redhack leader on iic later 
1000 defacements in a day 
or some shit 

rg/jabber.org: so you can meet him 
hardcore commies like me <3 
jabber.org: he loves me 
arg: haha 

i'd love to 
org/j&bber.org: during lulzsec I \ 
org/Jabber-org: turned into a 30 1 
rg/jabber.org: and they nrfd i 
heU yes 

labb-er.org: so those I gave you — high priority 
ok I will take a cbse took in about an hour or two 
I am slackin. on some emergency real world work tho unfortunately 



root to a few 
leiaces 
got mails 
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8/13/13 Conversation vwth vohoho@jabber.ccc.de at 1/25/2012 4:34:03 PM on l^nDava*ds<3n@j^ber.orgij9M)er.org (jabber) 

(4:52:13 PM) leojidavidson@jabber.o.rg/jabber,oj'g: yup 

(4:52:16 PM) leoBdavidsoo@jabber.0i^jabber,org: do what you gotta do 

(4:5220 PM) le0ndavids©n@jabber.org/jabbtT.org; then msg me so we can work on tis 

(4:52:26 PM) yohoho@jabbenccc.de: but keep comin up with lists like that tho 

(4:52:33 PM) yohoho@jabber.cccde : cause tfs easy to bang them out in a row 

(4:53: 16 PM) ]eondavidson@^bbe.r.org/jabbenai^: jea working on it ^^^^^ 

(5:05:34 PM) yohoho@ jabber.ccc.de : talkin to the guy who just defaced I Hacebook 

(5:05:55 PM) yohoho@jabber.ccc.de: canyouretweet something from anon4g about the defecement 

(5:06:03 PM) lcoudaivid$on@jabber.org/jabber.ox^: yup 

(5:06:55 PM) leondavMsor6@jaW>er.08^/jabber.org: bro 

(5:07:08 PM) Ie0ndavidso0@jabber.org/jabber.o?^: I mindfacked Symantec so bad they started releasing Oday 
and hotfixes 

(5:07:17PM) teondavid$on@jabber.org/jabber.oig: I 




;) 

jeaaaa 

shawty got potential trnnia be her sponsorrnrr 



(5:07:20 PM) yohoho@jabber.ccc.de: lol 
(5:07:23 PM) yohoho@jabber.ccc.de: fuckign ZFI 
(5:07:25PM) yohoho@jabber.ccc.de: ZDI 
(5:07:33 PM) leondavidson@jabber.ot^/jabber.Oi^: 
(5:14:57 PM) leondavids on@ jabbe r.org/jabber.org: 
(5: 15:05 PM) !eondavidson@jabber.org/jabber.org: 
(5:21:45 PM) yohoho@jabber.ccc.de: btw you ever get them boston hashes cracked 
(5:26:17PM) leondavicteoii@jabber.0rg/jabher.Q^: Mask 
(5:26:56 PM) yohoho@jabber.ccc.de: it's only like five 
(5:27:47 PM) leondavidson@jabber.org/jabber.org: bro 
(5:27:49 PM) Ieondavidson@jabber.org/jabber.0rg: yes 

(5:27:53 PM) leondavid$on@jabbenorg/jabber.o£g: I gave you the passes already 

(5:27:57 PM) lcondavidson@jabber.org/jabber.ots«* it was retarded passwords 

(5:23:01 PM) leondavid$on@jabber.org/jabber.org: likej 

(5:28:01 PM) yohoho@jabber.ccc.de: oh darn 

(5:28:02 PM) leondavidson@jabbenorg/jabber.o^: remember? 

(5:28:11 PM) yohoho@jabber.ccc.de: man sometimes I'm high ash hell 

(5:28:14 PM) yohoho@jabber.ccc.de: loose shit in the scrollback 

(5:28: 14 PM) le<mdavidson@jabber.org/jabber.org: ahahahahaha 

(5:28:19 PM) leondavidson@jabber»org/jabber.org: me too son 

(5:28:20 PM) leondavidson@jabber.ot^/jabber.org» me too 

(5:28:24 PM) yohoho@jabber.ccc.de : working on too much shit slips through 

(5:28:32 PM) yohoho@jabber.ccc.de: you ain't still got it tho?? 

(5:28:41 PM ) teondavidson@jabber.org/jabber*oi^: I dont log or save shit so I gotta ask my boy again 

(5:28:47 PM) leoAdavid$on@jabbenorg/jabber.org: give me a few 

(5:35:18 PM) yohoho@jabber.ccc.de: I love how we're gonna hit boston for a second time 

(5:35:35 PM) IeoBdavidsott@jabber.org/jabber.org: yo 

(5:35:39 PM) yohoho@jabber.ccc.de: But they asked for it by faekin with the occi^ation again, sending 
undercovers to assault organizers, and then suboena'in twitter for half the world 
(5:35:45 PM) leondavidson@jabber.org/jabber.0rg: do you remember gH ? 
(5:35:56PM) yohoho@jabber.ccc.de: hmm? no 
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(5:36:03 PM) 
DarknessX 
(5:36:13 PM) 
(5:36:22 PM) 
(5:36:25 PM.) 
(5:36:32 PM) 
(5:36:33 PM) 
(5:36:34 PM) 
(5:36:35 PM) 
(5:36:38 PM) 
(5:36:45 PM) 
(5:36:52 PM) 
(5:36:52 PM) 
(5:36:54 PM) 
(5:36:59 PM) 
(5:37K>2 PM) 
(5:37:03 PM) 
(5:37:06 PM) 
(5:37:08 PM) 
(5:37:11 PM) 
(5:37:20 PM) 
(5:38:06 PM) 
(5:38:10 PM) 
(5:54:57 PM) 
(5:55:03 PM) 
(5:55:39 PM) 



Case 1 :1 2-cr-001 85-LAP Document 69-3 Filed 04/1 6/1 4 Page 1 2 of 31 

Conversation with yohoho@jabber.ccc.de at 1/25/2012 4:34:03 PM on LeonDavidson@jabter.org4abber.org (jabber) 

leondavidson@jabber.oi^/ja bher.org: specifically any members named shdwknigfat The Knight or 

yoho ho@jabber.ccc.de: nope I do not know them 

iav!dson@jabber.org/jabbenorg: he came out of prison last year 
@jabber.org/jahber.org: did 7 years 
@jabber.org/jabber.org; gH - gbbalHell lamous group 
yohoho@jabber.ccc.de: in the US? 
Ieomlavidson@jabber.org/jabber,org: ytcrackerwas in it 
leondavid$on@jabber.org/jabbe r.org: yup 
yohoho@jabber.ccc.de: for what? 
leox3idavid$on@jabber.o! < g/jabber.org: hacking .mil 
Ie0Bdavidson@jabbcr,oi^/jabbenoi^: anyway last forward 

yohoho@jabber.ccc.de : shit I wasn't aware there were hackers who got more than a few years 
yohoho@jabber.ccc.de: besides brian salcedo 
Ieondavidson@jabber.org/jabber.O£g; he invited me to his channel 
er.org/iabbcr.ot 
nr.< 

!eondavldsoii@jabber.org/jabber.org: ownec 
IeondavidsoB@jabber.org/jabbenorg: maker of iphones 
Ieondavidson@jabber.org/jabber.org: look at admin menu 
ie oikla vids on@ jabbe r.org/f abbe r.org: £) 
yohoho@jabber.ccc.de; very nice 
yohoho@jabber.ccc.de: hit them hard then™) 
leo0davidsoii@jabber.org/jabber,org: redhack coming to ire shortly 
leondavidsonCffeiabbenon^jabber^ot'g : 1'U incite us to a chin to spit the shit 

abber.org! 





(5:55:40 PM) Ieondavidson@jabber.0rg/jabber.os^: <3 

(5:56: 19 PM) yohoho@jabbenccc.de: nice 

(5:56:24 pm) yohoho@jabber.ccc.de: f 11 be able to work on it then 

(5:58:36 PM) leondavidsoii@jabbenorg^abber.org: Date: Tue, 24 Jan 2012 19:1527 -0500 

From: PWber Optk <phiber@2600.COM> 

Subject: Re: hey man 



Thanks! Keep it real. . 



OnTue, Jan 24, 2012 at 06:5025PM -0500, Leon wrote: 

> was a tin of yours growing up m the scene, hope all is well on your end. 

> 

> -Sabu 

> LulzSec / #ANTISEC / Anonymous 

(5:58:42 PM) leondavfd$on@jabber.org/jabber.ot^: bro bve 
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8/1 3/13 Consersatton vwith vohoho@jabber.ccc.ds at 1/25/2012 4:34:03 PM on LeonDawdson@jabber.orgflabber.org (jabber) 

(5:58:50 PM) yohoho@jabber.ccc.de: lol 

(5:58:52 PM) yohoho@jabber.ccc.de: fuck 2600 tho 

(5:59:00 PM) leoi?davSdso0@jabber.org/jabber.org: true, but phiber optik is that nigga 
(5:59:02PM) Ieondavidson@jabber.o^/jabber.o^: doat front 
(5:59:08PM) !eondaYidso.n@jabber.oi^/jabber.o^: nigga was true unix ninja 
(5:59:10 PM) yohoho@jabber.ccc.de: yeah he's real deal 

(5:59:45 PM) !eondavidsosi@jabl>er.org/jabber.o?g: if it weren't for him, MoD and the hackers rnanifesto I 
probably would have gotten bored with this long ago 
(5:59:51 PM) leoHdavids0n@jabber.org/jabbes\org: haha 
(6:00:17 PM) yohoho@jabber.ccc.de: shit's ok 
(6:00:25 PM) yohoho@jabber.ccc.de: ok got oik of those 
(6:00:28 PM) yohoho@jabber.ccc.de: lemme know when redhack is on 
(6:02:23 PM) leoi&da\klsoii@jabl>er.O!^/jabber.o!^: kk one sec 

(6:02:32 PM) leoifidavtdson@jabber.org/jabber.org: he says hes on but hasn't msg'd me yet one seckz 
(6:02:46 PM) yohoho@jabber.ccc.de: oncryto? 

(6:03: 1 2 PM) leondavidson@jabber.org/jabber«org: ja waiting for the xnsg now 
(6:03:35 PM) yohoho@jabber.ccc.de: got two now 
(6:03:41 PM) leondavidson@jabber.org/jabber.org: uNF 
(6:13:47 PM) teoucbvidsoQ@^ibbcnorg/jabber.ois: accept invite 
(6:15:09 PM) yohoho@jabber.ccc.de: k 

(6:20:04PM) leondavidson@jabbenoi^/jabber,oi^: lol language barriers 
(6:20:08 PM) leoodavidson@jabber.org/jabber.o.rg: but hes cool 
(6:22:52 PM) leondavid?on@j^bber.0i^jabber.orga 




(6:23:01PM) leondavidsoo^jabbenotg/jabbenorg: looks like fuckin; 
(6:23:01 PM) leondavid$oj3@jabber.oi^/jabber.org: 'LOL 
(6:24:00 PM) yohoho@jabber.ccc.de: fucking NICE 
(6;24:il PM) leondavid50ii@jabber«oi^/}abber.oi^: yup 
(8:2i:26PM) Ieonda¥idson@jabber 0 o^/a539e07424efid28: yo yo 
(8:21:34 PM) yohoho@jabber.ccc.de: yo 



pvernment all uses plesk 
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8/13/13 Comersation with >ohoho@j3bber.ccc.de at 1/25/2012 4:34:03 PM on LeonOawdson@iabber.org/jabber.org (jabber) 

(8:21:35 PM) Ieondavidson@jabbenorg/a539e07424ef2d28: the niggas that owned( Jrom | 

just hit me up 

(8:2l:35PM) yohoho@jabber.ccc.de: one of these box es 
(8:21:39 PM) yohoho@jabbenccc.de: has 22 1 (mail 

(8:21:39 PM) Ieondavtdson@jabber.org/a539e07424e£2d28: yeah? 
(8:2 1 :42 PM) leondavidsoH@jabber.org/a539e07424ef2d28: oh wow 
(8:21:44 PM) Ieondavidsoo@jabber,org/a539e07424ef2d28: thats massive 
(8:21:44PM) yohoho@jabber.ccc.de: 2 2 domains 
(8:21 :47 PM) yohoho@jabber.ccc.de : oij 

(8:21:51 PM) teondavid8on@jabber.org/a539e07424ef2d28: thats real ownage 

(8:2i:56PM) yohoho@jabber.ccc.de: for real 

(8:23:24 PM) yohoho@jabber.ccc.de: and this is just one server 

(8:23:30 PM) yohoho@jabber.ccc.de: it actually tgs mail for -600 domains 

(8:23:35 PM) yohoho@jabber.ccc.de: almost all| 

(8:23:44 PM) yohoho@jabber.ccc.de: shit I wish we got this lucky 

(8:43:39 PM) feondavidson@jabber.org/a539e07424ef2d28: ya I know 

(8:41:53 PM) kondavidson@jabber.oi^/a539e07424e£2d28: thats going to be a repeat ofredhack's last 1000 
domain hit 

(8:41:54PM) Ieoiidavi(feon@jabber.oi > g/a539e07424ef2d28: hahaha 

(8:4l:59PM) feondteividbon@jabber.org/aS39e07424ef2d28: #antisec and RedHack team up 

(8:42:23 PM) yohoho@jabber.ccc.de: you on that ire? 

(8:44:27 PM) Ieondavidson@jabber.org/a539e07424ef2d28: let me check 

(9:34:14 PM) yohoho@jabber.ccc.de: I did download all the mail on our servers too 

(9:34:18 PM) yohoho@jabber.ccc.de: just in case they arent able to deliver 

(9:34:35 PM) Ieondavidsoii@jabber.oxg/a539e07424et2d28: got you 

(9:34:49 PM) Ieondavidsoii@jabber.org/a539e07424ef2d28: we can always release the mails if they dont 
(9:39:39 PM) yohoho@jabber.ccc.de: dude 
(9:39:39 PM) yohoho@jabber.ccc.de: dude 
(9:39:45 PM) yohoho@jabber.ccc.de: someloser owned 1 




(9:39:58 PM) leondavidsoM@jabber.O!-g/aS39e07424ef2d2? 
(9:39:59 PM) Ieondav]dson@jabbenoi^/a539e07424e£2d28: like 
(9:40:05 PM) yohoho@jabber.ccc.de: wait 
(9:4005 PM) leoiKlavid$on@] 
(9:40:13 PM) leondavidsoa@ jabber.o rg/a539e07424ef2d28: the one that talks shit about us all day 
(9:40:16 PM) yohoho@jabber.ccc.de: | Jpass hahaha 

(9:40:18 PM.) yohoho@jabber.ccc.de: check it out 
(9:40:22 PM) yohoho@jabber.ccc.de: it's probbiy not the same one tho 
(9:40:25 PM) yohoho@jabber.ccc.de: someloser just gave me this 
(9:40:33 PM) yohoho@jabber.ccc.de: he lias all his emails, dropbox. everything 
(9:41 :27 PM) Ieondavid$on@jabher.o^a539e07424ef2d28: yeah I dont thinlytyh^ame 
(9:41:32 PM) Ieondavidson@jabber.org/a539e07424ei2d28: you'd find his| Jlogin or somshit 

(9:41:34 PM) leondavid$on@jabbenoi%/aS39e07424ef2d28: hut 
(9:4i:36PM) feondavidsoii@]abber.org/a539e07424ef2(128: still big ownage 
(9:41:40 PM) yohoho@jabber.ccc.de: hah well it's some racist that is applying to be a cop 
(9:42:00 PM) Ieondavid$on@jabber.org/a539e07424ef2d28: yup 
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8/13/13 Conversation vrfth yohoho@jabber.ccc.de at 1/25/2012 4:34:03 PM on LeonDawdson@jaito.org/jabber,org (jabber) 

(9:46:33 PM) yohoho@jabber.ccc.de: hrm 

(9:46:37 PM) yohoho@jabber.ccc.de: so many targets homey 

(9:46:42 PM) yohoho@jabber.ccc.de: I think we need some additional talent onboard 

(9:46:47 PM) yohoho@jabberxcc.de: to help us sort, organize, and prepare these 

(9:47:06PM) yohoho@jabber.ccc.de: sometimes it seems too overwhelming, even for me 

(9:49:42 PM) yohoho@jabber.ccc.de: btw have you heard whether movl/x25 was arrested? 

(9:49:45 PM) yohoho@jabber.ccc.de: rumors say they were 

(9:49:49 PM) yohoho@jabber.ccc.de: like a day ago or somethin 

(9:50:57 PM) Ieondavidso)a@jabber*oi^/a539e07424ef2d28; ryan messaged me that 2 more were arrested 
(9:51 :32 PM) yohoho@jabber.ccc.de: yeah that's what ifs about right? 
(9:5i:34PM) yohoho@jabber.ccc.de: but 

(9:51:38 PM) yohoho@jabber.ccc.de: why would he know about US arests? 

(9:5i:40PM) yohoho@jabber.ccc.de: or are they UK? 

(9:51:41 PM) leondayidsoB@jabber.org/a539e07424ef2d28: yup 

(9:51:44 PM) Ieondayidson@jabber.org/a539e07424ef2d28: us 

(9:5h53PM) Ieondavid$on@jabber.oi%/a539e07424cf2d28: might be 2 others 

(9:53:29 PM) Ieondavidson@jabber.org/ / a539e07424eQd28: s for new talent 

(9:53:38 PM) ieondavidson@jabber«org/a539e07424e£2d28: we have a few candiates 

(9:53:55 PM) leoitdavidson@jabber.org/a539e0?424ef2d2S: just cant em 

(9:54:02 PM) Ieondavidson@jabber.org/a539e07424ef2d28: make em do small siiit 

(9:54:09 PM) Ieondavidson@jabber a org/a539efl7424ef2d28: god = one ofthein 

(9:54:14 PM) yohoho@jabber.ccc.de: yeah maybe like wing them one target or two 

(9:5423 PM) yohoho@jabber.ccc.de : I actually did hook god up wit h two targe ts I was too lazy to finish up 
(9:54:29 PM) yohoho@jabber.ccc.de: includin g a live sq linjection on j 
(9:54:34 PM) yohoho@jabber.ccc.de: and the | (targets 
(9:55:02 PM) Ieondavid$on@jabbenorg/a539e07424ef2d28: ja 
(9:57:19 PM) yohoho@jabber.ccc.de: hey also 
(9:57:21 pm) yohoho@jabber.ccc.de: 




(9:57:23 PM) yohoho@jaWber.ccc.de: wat was the pass? 

(9:58:52 PM) kondavidson@jabber.oi^/aS39e07424efid28; hOhO 

(9:59:27 PM) yohoho@jabber.ccc.de: wait the rar wasn't encrypted anyway 

(9:59:35 PM) IeondavidsoB@jabber.oi^/a539c07424ef2d28: LOL 

(9:59:39 PM) yohoho@jabber.ccc.de: and looks delicious =) 

(9:59:39 PM) Ieoiidavid$on@jabber.otg/a539e07424ef2d28: nig 

(9:59:44PM) Ieondavidson@jabber.oig/a539e07424e£2d28: yup 

(10:25:33 PM) Ieonditvidson@jabber.org/a539e()7424eOd28: what you up to nig 

(10:25:59 PM) yohoho@jabber.ccc.de: well 

(10:26:03 PM) yohoho@jabber.ccc.de: later I gotta chill with the girl 

(10:26:06 PM) yohoho@jabberxcc.de: and no net=( 

(10:26:17 PM) yohoho@jabber.ccc.de: actually I have to leave soon 

(10:26:36 PM) leondaYidson@jabbcr.org/a539e07424ef2d28: me too girls staying over 

(10:26:41 PM) lcondavidson@jabber.oi^af^ 

(10:37:27PM) yohoho@jabber.ccc.de: bt\vj |op 

(10:41:14 PM) ieonda vidson@jabber,org/a539e07424ef2d28: yea! !!!!!! 
(10:41:16PM) leondavklsofi@jabbcr.oi^aS39e07424ef2cl28: nice 
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8/13/13 Conversation \wth yDhoho@iabber.ccc.de at 1/25/20124:34:03 PM on LeonDawdson@jabber.org/jabber.org Qs&toer) 

(10:51.12 PM) yohoho@jabber.ccc.de: also 
(10:51:12 PM) yohoho@jabber.ccc.de: \ 

(10:51:35 PM) )eondavid$on@jabbenorg/aM9eir/4Z4eiZfi^5: nice 
(il:26:09PM) yohoho@jabber.ccc.de/ghost has ended his/her private conversation with you; you should 
do the same. 
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9/13/13 Ccn^sationwthyjhdw^abber.ccc.de at 1/26/2012 1:28:12 PM on LeonDavidson@jabber.orgy5abber.org (jabber) 



Conversation with yohoho@jabber,cec.de at 1/26/2012 1:28:12 PM on 
LeonDavidson@jabber.org/jabber.org (jabber) 

(1:28:14PM) leondavidson@jabbenojrg/jabber.org; yOOOOOOOOOOOOOOOOOO 
(i:28:24PM) Unverified conversation with yohoho@jabbe rxcc.de/Minerva started* 
(l:36:45PM) yohoho@jabber.ccc.de: yoyo 
(l:36:46PM) yohoho@jabber.ccc.de: whafs good 

(]:37:ii PM) 1eondavidsoii@jabber.org/jabber.org; chillinnnrmrmnnnnnnrmmnnnn 
(1:37:18 PM) yohoho@jabber.ccc.de: yep me too 
(l:3720PM) yohoho@jabber.ccc.de : at work currently 

(1:58:55 PM) leondavidsoH@jabber.oi^/jabber-org: reading more about bb I'm loving that shit 
(1:59:06 pm) leondavidson@jabber.ojrg/jabber*org: they got meetups in nyc? 
(2:03:13 PM) yohoho@jabber.ccc.de : it's not reatty a group persay 

(2:03:20 PM) yohoho@jaWier.ccc.de: but a tactic used at demonstrations by like minded people 

(2:03:45 PM) yohoho@jabber.ccc.de : though there are often affinity groups/crews who already know and trust 

each other that work within black blocs 

(2:04:02 PM) yohoho@jabber.ccc.de : best bet to find circle A types is probably chill at abc no rk>, the 
occupation, or punk shows 

(2:04:06 PM) yohoho@jabber.ccc.de : there's plenty in NY I know 

(2:04:25 PM) yohoho@jabber.ccc.de : also it hink the badass zine firetotteprisons.com is based outta NYC 

(2:04:37 PM) yohoho@jabber.ccc.de: then there's this bigass collective house there called surreal estate 

(2:04:49 PM) yohoho@jabber.ccc.de: and umm this other place that I think closed down called 123 or somethin 

(2:05:05 PM) !e0nd&vidscm@jabber*org/jabher.org: yea 

(2:05:31 PM) leondavidson@jabber.oi^/jabber.org: Til check it out 

(2:05:55 PM) yohoho@jabber.ccc.de: shit if I ever end up in NYC M smoke a fotty with ya 

(2:08:16 PM) le0ndavidson@jabher.drg/jabber.0rg: jea nigga 

(2:08:45 PM) leondavidson@jabber.org/jabbenorg: when you finish with work let me know so we can get to 
work on targets 

(2:08:47 PM) Ieondavidson@ja!>ber,0s^/jabber.org: another thing 
(2:08:52 PM) y ohoho@jabbe recede : k 

(2:09:03 PM) leondavldsosi@jabber.org/jabber.o^: those kids that hacked I B- 1 walked them step by 
step into getting into the mail server 
(2:09:13 PM) yohoho@jabber.ccc.de: LOL. 

(2:09:15 PM) lcondavidson@jabbenorg/jabbenoig: they're looking for iphone 5 schematics 
(2:09:26 PM) yohoho@jabber.ccc.de: oh yeaH?? 

(2:09:20 pm) leondavidson@ jabber.org/jabber.org: yup ^^^^^h 

(2:09:45 PM) Ieondav.id$on@jabbenorg/jabber.org: they rooted two ubuntu serversl Ithc rest are 

windows 

(2:09:56 PM) leoiMSavidson@jabber.org/jabber,oi^: but they're mainly newbies. but I give them props - they 
mad e it this for 

(2:10:02 PM) yohoho@jabber.ccc.de: so they got maiL? 

(2:10:30 PM) yohoho@jabber.ccc.de: I'm still waiting on alex to pop on so he can help me with this windows 
target 

(2:10:41 PM) leondavidson@jabber.org/jabber.org: they have 5 servers and are working on mail server now 
(2:10:42 PM) ieondavid$en@jabber.os^/jabber.org: yeah 
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8/13/13 Conversation with yohoho@jabber.ccc.<te at 1/26/2012 1:28:12 PM onLeonDa«dson@jabber.org/iabber.org (jabber) 

(9:28:05 PM) Your message was not sent Either end your private conversation, or restart it 

(10:04:01 PM) Your message was not sent Either end your private conversation, or restart it 

(10:04:02 PM) Your message was not sent Either end your private conversation, or restart it 

(10:04:06PM) Private conversation with yohoho@jabber.ccc.de lost 

(10:04:08PM) Attempting to start a private conversation with yohoho@jabber.ccc.de... 

(10:04: 1 J PM) Ieondav]dson@jabber.org/al2dcd98a30c36c2: yo you ok? 

(10:04:15 PM) ^verified conversation with yohoho@jabber.ccc.de/ghost started. 

(10:04:25 PM) yohoho@jabber.ccc.de: yoyo 

(10:04:30 PM) yohoho@jabber.ccc.de: yes just tired 

(10:04:32 PM) yohoho@jabber.ccc.de: hah 

(10:04:34 PM) yohoho@jabber.ccc.de: what's good 

(10:04:44 PM) Ieondavidson@jabber.oi^/al2dcd98a3(k36c2: ;P 

(10:04:54 PM) ]eoitdavidson@jabber*org/al2dcd98a30c36c2: you see this drama on twitter? 
(10:04:55 PM) yohoho@jabber.ccc.de: reading about those two people in france who were busted 
(10:04:59 PM) yohoho@jabber.ccc.de : no sup ^^^^^^ ^^^^ 

(10:05:05 PM) Icondavid^i@jabber.org/a!2dcd98a30c36fi!2^^^^^Bceo oM Bbasicafly 
challenging us to hackjj Jgain 

(10:05:12PM) Ieondavidson@jabber.org/al2dcd98a30c36c2: saying we are terrorists 
(10:05:15 PM) yohoho@jabberxcc,de: lol 
(10:05:16 PM) leond&v ids on(3) jabber.* 




(10:05:27 PM!) 
(10:05:30 PM) 
(10:05:43 PM) 
(10:05:50 PM) 
(10:05:58 PM) 
(10:06:30 PM) 
(10:07:08 PM) 
(10:07:37 PM) 
(10:07:42 PM) 
(10:49:30 PM) 
(10:49:44 PM) 
on here 
(10:49:45 PM) 
(10:49:50 PM) 
(10:49:59 PM) 
(10:50:00 PM) 
(10:50:03 PM) 
(11:37:01PM) 
(11:37:05 PM) 
(11:37:18 PM) 



t some sqii 

yohoho@jabber.ccc.de: hack it again? what's the point 

org/al2dcd98a30c36c2: we didrft hack it in the first place 
org/al2dcd98a30c36c2: t was a dns hijack by some other niggas 
org/al2dcd&8a3Qc36c2: the point would be the fulz 
yohoho@jabber.ccc.de: oh right hah 

teondavidson@jabber.o^g/al2dcd98a30c36c2: anyway you good? you awake or going to bed? 
yohoho@jabber.ccc.de: i'Ube up for a minute 
yohoho@jabber.ccc.de: dumping some hotmail riglit now 
yohoho@jabber.ccc.de: any new targets? 

yohoho@jabber.ccc.de: I tried a few, got( |ut there ain't shit 

Ieondavidson@jabber.org/al2dccE>8a30c36c2: did you hit those govs I gave you last night? 
yohoho@jabber.ccc.de: not aE of them 

yolioho@jabber.ccc.de: lemme breeze through to see wfrd^n^pod or not 
Icondavidson@jabbcr.org/al2dcd98a30c36c2: the norm Ines 
Ieondavidson@jabber.org/al.2dcd98a30e36c2: kk 
yohoho@jabber.ccc.de: ok 
yohoho@jabber.ccc.de: got that list 
yohoho@jabb er.ccc.de : 

- rooted 

' nope 
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Conversation wth YDhohQ@jabber.ccc.de at 1/26/2012 1:28:12 PM on LeonDavicteon@]£4)ber.org/jabb€r.org (jabber) 

' <- passwords 
- windows 



- nope 
windows maybe passies 
'» windows passies 




(slaverY) <- nope 



r LoD) <- windows passies 

- rooted 
windows 

- nope 

- win dows (passies) 
<- nope 

(interesting ( nope 

nope 

(in bed wit govt) «- rooted 
<- not 



windows 
- rooted 
rooted 




- rooted BIG 
b (nope) 

- rooted, big 
- windows 

rooted (same as one of the above) 

I- rooted lots of rmil 




(slavery) <- none 
I n0 P e 

(12:14:15 AM) yohoho@jabber.ccc.de: yoyo 

(3:18:39 AM) leonda:vidsoa@jabber.oi^/|abber.oi^: yoyo 

(3:18:41AM) leondavid.son^abber.o^/ja'bber.org: you there? 
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8/13/13 Conversation wth yohoho@jabber.coc.de at 1/26/2012 1:28:12 PM on LeonDavidson@jabber.org/jabber.org (jabber) 

(10:15:48 PM) Ieondavidson@jabl3er.org/8382bfea3c285§83: nein mem bmder 

(10:16:10 PM) yohoho@jabber.ccc.de: I am so fucked on this target going down 

(10:16:23 PM) yohoho@jabber.ccc.de: I never been this bitter about losing some data as I am now 

(10:16:42 PM) Ieondavids0n@jabbenorg/8382bfea3e285583: it happens bro. dont beat yourself over it 

(10:16:49 PM) k©ndavidson@jabber.org/8382bfea3c285583: theres others to work on in the meantime 

(10:18:33 PM) yohoho@jabber.ccc.de: I am glad there is at least more thar^^wsDoolsui^r^hisnow. 

rg/8382bfea3c285583: check I land 
[they're windows, but passies is fine for now 




(10:19:36 PM) yohoho@jabber.ccc.de: look at this 
(10:19:39 PM) yohoho@jabber.ccc.de: uname 



drwxr-x-- 32 root roo^^Kep 7 14:33 . 
drwxr-xr-x 37 root roo^HKep 1 02:17 

-rw 1 root root I |Aug 31 10:04 

drwx- 3 root root| | Dec 14 2009 

-rw- 1 root ro| [Jul 28 201 1 

drwx- 2 root roc^^|fcep 6 07:39 

-rw- 1 root roo| |jan 16 1435 

-rw-r-r- 1 rootrootMjul 12 2006 
-rw-r-r- 1 root root^Boct 18 2007 
-rw-r-r- 1 root root^JJul 12 2006 

drwx- 3 root roo^M Sep 19 2007 

-rw-r-r- 1 root roofpul 12 2006 

-rw 1 root rootMSen 1 7 200 

drwxr-x— 2 root rootJHsep 17 2007 

_ rw i root rootBgep 18 2007 

drwx- 4 root I lAug 3 1 1 004 

drwx- 2 root. I Lug 3 1 22:16 

drwxr-xr-x 3 root I Isep 17 2007 

drwx- 8 root I Lug 28 01 :09 

drwx- 2 root I lse P 17 2007 

drwxr-xr-x 2 root I Isep 17 2007 
-rw-r-r- 1 root roo B^ep 17 2007 

drwx- 3 root nM |Oct 16 2007 

-rw 1 root roc^^^Han 11 12:16 

drwx- 3 root rol Isep 17 2007 

drwx 3 root rol Isep 17 2007 

-rw 1 root rol Bep 7 14:33 

drwxr-xr-x 3 root rol lAug 28 01 :0 
drwxr-xr-x 2 root ro| loct 16 2007 
-rw 1 root root^Epr 7 2010 
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-rw-r-- r-- 1 root root Aug 27 23:4' 
drwxr-xr-x 3 root root^Hsep 17 2007 1 

.rw- ] r0 ot root H^ep 17 2007 

drwx- 2 rootroot^HApr 16 20091 

drwx- 2 rootroot^Msep 20 2007 1 

-rw-r— r— 1 root root I ■ 12 2006 

drwx- 3 rootroo^^BDec 15 20091 

-rw- 1 root ro <l B\ug 28 00:501 

drwxr-xr-x 2 root ro^HHNov 13 200S 

.rw i rootroot^Pep 19 2007 \ 

-rw-r--r- 1 root roofl | Dec 18 2008 25 
drwxr-xr-x 4 root roJ nug 31 1 0:1 6| 
-rw-r-r— 1 root roo^^Mvlav 31 2011 




; gc'imes I 



-rwxr-xr-x 1 root 
-rwxr-xr-x 1 root root_2 

-rw 1 rootroo 

-rw-r— r— 1 root root 
-rw-r— r— 1 root root 
-rw-r—r— 1 root root 
-rw-r— r— 1 root root 
-rw-r—r— 1 root root 
-rw-r—r— 1 root root 
-rw-r—r— 1 root root 
-rw-r—r— 1 root root 
-rw-r—r— 1 root root 
-rwxr— r— 1 root game 
drwxr-xr-x 2 root root 
-rw-rw-r— l root 
-rw-rw-r— l root 
-rw-rw-r— 1 root ga; 
-rw-rw-r— 1 root 
-rw-rw-r— 1 root 
-rw-rw-r— 1 root games| 
-rw-rw-r— 1 root gat 
-rw-rw-r— 1 root game! 
-rw-rw-r— 1 root game: 
-rw-rw-r— 1 root games, 

drwx 2 root rqo 

-rw-r—r— 1 rootro 
-rw-r—r-- i rootroo 
drwxr-xr-x 6 root root 
drwxr-xr-x 10 root 
-rwxr-xr-x 1 root e 




11 2008 
ug31 22J 
Sep 17 2007 
2 2010 
ct 14 2010 
Oct 14 
4 201 
r 22 200 
ov22 2007 
ct 16 2007 
Sep 17 2007 
17 200 " 
Mar 27 
19 2007 
Dec 12 200 
)ec 12 2008 
Dec 12 2008 
Dec 12 2008 
Dec 12 2008 
Dec 12 2008 
Dec 12 
ec 12 2008 
Dec 12 2008. 
Dec 12 200 
24 2007| 
31 22:07 
eb 12 2009 
/22 2010 
ov22 201 
c 1 1 200 
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Con\ersation wth yDhc^io@jabber .ccc.de at 1/26/2012 1:28:12 PM on LeonDawdson@jabber.org/(abber-org (jabber) 



~rw-r— r— 1 root roo 
drwxr-xr-x 2 root root 
drwxr-xr-x 3 root root 
~rw~r— r— 1 rootrootl 
drwxr-xr-x 6 root root 
drwxr-xr-x 6 root root 
Dtroot 





■ root roo 
drwxr-x— 32 root root 
-rw-r--r-- 1 root root 
-rwxr-xr-x 1 root root 
-rw-r— r— 1 root root 
-rw-r—r— 1 root root 
-rw-r— r~ 1 root root 
-rw-r—r— I root root 
-rw-r~r— 1 root root 
-rw-r—r— 1 root root 
-rw-r— r— 1 root root 
-rw-r—r— 1 root root 
-rw-r—r— 1 root root 
-rw-r—r— 1 root roo 
-rw-r—r— 1 root roo 
-rw-r— r— 1 root roo 
-rw-r—r— 1 root roo 

-rwx 1 700 roo 

drwxr-xr-x 2 root roo 
-rw-r-r— 1 root root 
drwxr-xr-x 8 clauroj 
-rw-r—r— 1 root roo 
-rw-r—r— 1 root root 
-rw-r—r— 1 root root 



e P 7 1 
6 04:52 
p 17 200 

ay 31 20, 
p 6 01:36 
p 6 06:47 
ov 17 2009 




_Aug31 10:16. 
>ep7 14:33 1 
he 15 2009 
Hig8 2007 
|ep 19 2007 
[24 2008 " 
fee 1 2008 
fov9 201 
lAug31 10: 
^pr 8 201 
^pr 7 201 
^ug31 1 
Jov9 2010 
8 2008 
)ct 8 2008 
r 28 2007 

'7 2010 
|Sep 17 200 
Jov26 200: 
|Octl6 2007 
|Oct 16 
16 2007 
let 5 201 





w 20 201^ 

(10:20:23 PM) leondavidson@jabber,org/8382bfea3c285583: correo.. que bueno compaieso es unfijektag 
maifeerver lol 

(10:20:43 PM) yohoho@jabber.ccc,de: si 

(10:20:54 PM) yohoho@jabber.ccc.de: puedo hablar in espanolmas o menos 
(10:21:05 PM) leoadavSdsoa@jabber.08^/8382bfea3c285S83: oh shit :) awesome 

(10:21:17 PM) leouda%'idson@jabber.oi^/8382bfea3c285583: soyboricua papi uno de los unicos de la isla 

(10:21:41PM) yohoho@jabber.ccc.de: yo se 

(10:21 :52 PM) yohoho@jabber,ccc.de : thafs wliat they say ™) 

(10:21:55 PM) Ieondavidson@jabber.org/83821>fea3c285583: ;) 

(10:22:24 PM) yohobo@jabber.ccc.de : lemme find out you another one of them 1 5 year old white kid in your 
parents basement in long island 
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8/13/13 Conversation vath *ohoho@abber.ccc.de al 1/26/2012 1:28:12 PM on LeonDaycison@jabber.org^b^.org (jabber) 

(10:22:36 PM) yohoho@jabbenccc.de: loL 

(10:22:43 PM1 leondavidson@jabber.oi^/8382bfta3c285583: haha yeah right nigga 

(1023:07 PM) l e oiidavicteo^@,pbber.org/8382Mea3c285583: yo fend me an hour ofyourtimeto bang out 

these targets 

(10:23:13 PM) leondavldson@jabber.oi^/8382bfea3c285583: goign to cherry pick important ones 
(10:23:47 PM) yohoho@jabber.ccc.de : ok 
(10:23:48 PM) yohoho@jabber.ccc.de: let's do it 

(10:24:04 PM) leooda\idson@jabber.org/8382Mea3c285583: ok give me a few minutes to research 
(10:25:09 PM) leoRdavidso!i@jabber.org/8382bfea3c285S83: (10:24:04 PM) 
Ieondavidson@jabber.ot^8382bfea3c285583: ok give me a few minutes to research 
(10:25:18 PM) yohoho@jabber.ccc.de: back ^^^^^ 
(10:25:29 PM) yohoho@jabber.ccc.de: I'll put passies on| 
(10:25:33 PM) icoodsavids<BH@jabber.o^/8382bfea3c285S83: kk 
(10:25:43 PM) Ieondavidson@jabber.os^/8382bfea3c285583: you got those 2 
(10:26:01 PM) yohoho@jabber.ccc.de: have to reget them. 2 mini 
(10:26:35 PM) ieondavidson@jabber.oi'g/8382bfea3c285583: kk 
(10:26:58 PM) leofidavidsen@jabbe r.org/8382bf ea3c285583 : 1 



(10:27:27 PM) yohoho@ jabber.ccc.de: those are new ores? 

(10:27:42 PM) Ieondavidsofl@jabber.org/8382bfea3c285583: the ones I gave before 
(10:27:47PM) leondavidsoi]@jabbenorg/8382bfea3c285583: looking at other Jnow 
(10:28:02 PM) yohoho@jabber.ccc.de: ok 




(10:33:38 PM) yohoho@jabber.ccc.de : actually none of those two work 
(10:33:40 PM) yohoho@jabber.ccc.de: those first two 
(10:35:23 PM) Ieondavidsoii@jabber.oi^/8382bfea3c285583: kk 
(10:36:47 PM) yohoho@jabber.ccc.de: that last one is the only on e that works 
f 10:36:48 PM) yohoho@:iabber.ccc,de: 



(10:38:04PM) yoJiolio(^jaDDeTcS??ue: and that last one is now rooted 
(10:40:51 PM) yohoho@jabber.ccc.de: gotj 

(10:41:38 PM) Ieondavidson@jabber.org/8382bfea3c285583: looking, theres madBtargets but mainly hosts 

and shit not in the mood to be going through useless shit m 

(10:41:57 PM) yohoho@jabber.ccc.de: yeah well 

(10:42:04 PM) yohoho@jabber.ccc.de: we got other shit to do anyway 

(10:42:07 PM) !eo3idavids0E@jabber.org/8382bfea3c285583: kk 

(12:09 24 AM) yohoho@jabber.ccc.de: yo 

(i:02:26AM) Ieondavid$on@jabber.org/8382bfea3c285583: yooo 

(1:02:31 AM) Ieondavidson@jabber.org/8382bfea3c28S583: sorry nigga I got bored and fell off 
(1:02:33 AM) leondavidson@jabbenorg/8382bfea3c28SS83: whats goodie? 
(1:03:04 AM) leoiMlavjdson@jabber.org/8382bfea3c285583 

I got these? 

(1:27:28 AM) yohoho@jabber.ccc.de : yoyo 
(1:27:31 AM) yohoho@jabber.ccc.de: lemme try it real quick 
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8/13/13 Conversation with johoho@jabberccc.de at 1/26/2012 1:28:12 PM on Leor^avidson@iabber.cffg/|abber.org (Jabber) 

(1:28:26 AM) yohoho@jabber.ccc.de: ugh 

(1:28:29 AM) yohoho@jabber.ccc.de: both fi> them are patched 

(1:35:32 AM) leondavid$on@jabber.oig/8382bfea3c285583: watching akira 

(l:35:34AM) leondavid$fon@jabbenorg/8382bfea3c28S583: like jEAAA 

(1:35:41 AM) Ieoiidavidson@jabbenorg/8382bfea3c285583: KANEDA!!!!!!!!!!!! 

(l:36:30AM) yohoho@jabber.ccc.de: hey 

(1:36:56 am) yohoho@jabber.ccc.dc: do you tsiil have that script that person wrote to automate dumping shit 
from queries on a site 

(l :37:38 AM) yohoho@jabbe r.cccde : iv'e been working on this one target and I have admin panel but no way to 
upload or do anything else 

(l :37:43 AM) yohoho@jabbe r.cccde : and all the orders have gold in them but I can't mass dump it 
(1:38:24 AM) yohoho@jabber.ccc,de: I should just write it myself . . have to tweak it a bit anyway to use 
cookies and shit 

(1:44:29 AM) leondavldson@jabter.oi^/8382bfea3c28S583: that ruby script? 

(1:45:27 AM) yohoho@jabber.ccc.de: ugh nevermind 

(l:56:34AM) teoiubvid$on@jabbenorg/8382bfea3c285583: cant find it 

(i:56:38AM) Ieondavidson@jabber.org/8382bfea3c285583: idont save shit 

(1:56:43 AM) yohoho@jabber.ccc.de: yeah 

(i:56:46AM) yohoho@jabber.ccc.de: no probs Ndo it 

(2:49:49 PM) yohoho@jabber.ccc.de: yoyo 

(2:50:23 PM) leoRdavid$on@jabbenorg/c4ace0e64dtb20e8: guess where I went nigga 
(2:50:33 PM) te onda vids on@jabbe r.org/c4ace0e 64dfb20e 8: took the walk 
(2:50:35 PM) Ieoadavldsoii@ jitbber.org/c4ace0e64dfe20ei 
(2:50:36 PM) teo{idavidS8>ii@jabber.oE-g/c4ace0e64d{b20e8: ROFL 
(2:51:08 PM) yohoho@jabber.ccc.de: LOLOL 
(2:5l:09PM) yohoho@jabber.ccc.de: hahaha 
(2:51:2 1 PM) yohoho@jabber.ccc.de: ahhs hit 
(2:5l:22PM) yohoho@jabber.ccc.de: soon they will be board ed up 
(2:51:25 PM) yohoho@jabber.ccc.de: yo so I just ownecyit^^^Bministiy of 
(2:5l:33PM) yohoho@jabber.ccc.de: its #2 target inB Bight now 
(2:53:39 PM) leoEidavtdson@jabber.org/c4ace0e64d["b20e8: no way 
(2:51:43 PM) Ieondavidson@jabber.org/c4ace0e64df1)20e8: good shitiam 
(2:51:53 PM) Ieondavid$on@jabber.org/c4ace0e64dfb2Qe8: sqli or plesk? 
(2:52:01 PM) yohoho@jabber.ccc.de: it's passwords only though 
(2:52:03 PM) yohoho@jabber.ccc.de: have to login to lip and shit 
(2:52:08 PM) yohoho@jabber.ccc.de: have to backup database manually 
(2:52:19 PM) Ieondavid$OR@jabber.org/c4ace0e64dfl>20e8: got you 
(2:52:20 PM) yohoho@jabber.ccc.de: it's plesk 
(2:5224 PM) yohoho@jabber.ccc.de: gonna try more^HMargets too 
(2:52:25 PM) Ieomdavidson@jabbenoi^/c4ace0e64dfb20e8: thats great^^^Hwilljizz 
(2:52:49 PM) yohoho@jabber.ccc.de: yeah a lot of anarchist prisonennn^B^^ 
(2:53:45 PM) Ieondavid$on@jabber.org/c4ace0c64dfb20e8: scan^H^Betworks for freebsd telnet and 
tomcat too 

(2:53:50 PM) Ieondavidson@jabber.org/c4ace0e64dfb20e8: best bet: root a vps provider 
(2:53:55 PM) Ieondavtd$on@jabber.org/c4ace0c64dfb20e8: and create your own vps container 
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Conversation with yohoho@jabber.ccc.de at 2/2/2012 3:34:58 PM on 
LeonDavidson@jabber.org/j a bber.org (jabber) 

(3:35:00 PM) !eondavidson@.jabber.org/jabber.org: 

hf1y//www.austmchro^^ 

(3:35:02 PM) ieo«davidson@jabber.org/jabher,org: uNF 

(3:35:03 pm) Unverified conversation with yohoho@jabber.ccc.de/ghost started. 

(3:35:10 PM) Successfully refreshed the unverified conversation with 

yohoho@jabber.ccc.de/ghost 

(3:37:18 PM) leondavidson@jabber.org/jabbcr.org: yo son when we doing this drop 

(3:37:22 PM) icondavidson@jabber.org/jabber.org; tonigt or tomorrow 

(3:37:33 pm) yohoho@jabber.ccc.de: we need to get it out before 8am in the US 

(3:37:50 PM) yohoho@jabber.cccde: so media can pick up on it and report on it before the 

weekend 

(3:40:06 PM) leondavidson@jabber.org/jabber.org: yup 

(3:40:39 PM) yohoho@jabber.ccc.de: maybe issue vague calls to action for tomorrow 
(3:43:54 PM) leondavidson®abbcra>rg/jabbcr.org: let me know how you want me to handle 
twitter / people 

(3:43:58 PM) leondavidson@jabbenorg/jabber.org: medias already looking over my shit 

(3:43:59 PM) leondavid5on@jabber.org/jabber.«rg: forFFF 

(3:44 02 PM) leondavidson@jabber.org/jahber.org: so niggas are hungry 

(4:00:10 PM) yohoho@jabber,ccc,de: yo 

(4:00:31 PM) yohoho@jabber,ccc.de: maybe put something like 'calling all allied crews: 

tomorrow let us unite and open fire upon enemy battleships #fff 

(4:00:32 PM) yohoho@jabber.ccc.de: r something 

(4:04 51 PM) leondavidson@jabber.org/4440320dB31817c5: got you 

(4:05:39 PM) yohoho@jabber.ccc.de: booty prepped, backdoors secured, tomorrow we open fire. 

allied crews, unite and fight 

(4:05:40 PM) yohoho@jabber.ccc.de: some shit 

{4 05:57 pm) ieotBdavidson@jabbenorg/4440320d831817c5: got you 

(4:10:54 PM) leondavidson@jabber.org/4440320<I831817c5: posted on twitter 

(4:11:03 PM) yohoho@jabber.ccc.de: lookin good -) 

(4: 1 1 :07 PM) yohoho@jabber.ccc.de: get them droolin 

(4:11:15 PM) yohoho@jabber.ccc.de: debating whether to deface a site tonight 

(4:11:19 PM) yohoho@jabber.ccc.de: or whether we shoudl do it all tomorrow 

(4:11 :34 PM) Icondavidson@jabher.org/4440320d831817c5: you gonna be out? otherwise HI go 

do some shit, otherwie I'll stay around with you today to handle that shit 

(4:11:44 PM) Ieondavidson@jabber,org/4440320d831817c5: which site? the lawyers shit 

(4:1 1:45 PM) Icondavidson@jabber,©rg/444fl320d831817e5: ? 

(4:12:03 PM) yohoho@jabber.ccc.de: lawyers tomorrow early am or late late tonight 

(4:12: 17 PM) yohoho@jabber.ccc.de: probably will just wait and do it all at once 

(4:12:33 PM) Ie<nidavidson@jabber.org/4440320d83l817c5: nah cause then itll be all rushed 

shit, dont burnt yourself out homey 

(5:25:04 PM) leondavid$*m@jabber i org/jabber.org: back 

(5:25:14 PM) yohoho@jabber.ccc.de: yo 

(S:03:44 PM) leondav«dson@jabber.org/jabber.org: love u 
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(8:04:00 PM) yohoho@jabber.ccc.de: <3 

(8:04:03 PM) yohoho@jabber.ccc.de: yo man Im beat 

(8:04:05 PM) leondavidson@jabber.org/jabber.org: <e3 

(8:04:10 PM) yohoho@jabber.ccc.de: I am gonna let this upload for 2 hours or so 

(8:04: 13 PM) yohoho@jabber.ccc,de: while I nap 

(8:04:19 PM) IeondavSdson@jabber.org/jabber,org; you been at it all day? 

{8:04:28 PM) yohoho@jabber.ccc.de: and all last night 

(8:04:30 PM) yohoho@jabber.ccc.de: worked today 

(8:04:33 PM) yohoho@jabber,ccc.de: i'm done 

(8:04:46 PM) yohoho@jabber.ccc.de: ill be back in a few hours tho 

(8:05:52 PM) leondavidson@jabber.org/jabb£t\org: gotubro 

(8:06:23 PM) leondavidson@jabber.org/jabber.org: goodnight pa 

(8:06:33 PM) yohoho@jabber.ccc.de: <3 

(9:35:19 PM) leondavIdson@jabber.org/jabber.org: yo yo 

(10:05:57 PM) ieondavidson@jabber.org/jabber.org: that was a quick nap mother fucker! 

(30:05:58 PM) Ieondavidson@jabber,org/jabbcr.org: haha 

(10:06:24 PM) yohoho@jabber.ccc.de: damn u on my ass 

(10.06:32PM) yohoho@jabber.ccc.de: ugh tired 

(10:06:45 PM) yohoho@jabber.ccc.de: but it finishd uploadn 

(10:07:29 PM) Ieondavidson@jabber.org/jabbei\org: hahahaha 

(10:07:30 PM) lGondavidson@jabber.org/jabber.org: nigga 

0.0:07:35 PM) !eondavidson@jahber.org/jabber.org: I'm fucking super hyper 

(10:10:46 PM) yohoho@jabber.ccc.dc: that's good 

(10: 10:49 PM) yohoho@jabber,ccc,de: i'll get up to speed in a minute 

(10:11:01 PM) Ieondavtdson@jabber.org/jabber.org: yup 

(10:1 1:10 PM) yohoho@jabber.ccc.de: and then it's all night action 

(10:1 1:16 PM) Ieondavidson@jabber.org/jabber.org: im here with you 

(10:ll:35PM) yohoho@jabber.ccc.de: first let me render these emails 

(10:1 1 :36 PM) yohoho@jabber.ccc.de: also 

(10:1 1 :44 PM) Ieondavidson@jabber.org/jabber.org: p.s. people think you're kayla 
(10:1 1:46 PM) yohoho@jabber.ccc.de: I am running some queries on the stratfor mail 
(10:11:48 PM) leoindavidson@jabber,org/jabber.org; which is a compliment 
(10:1 1:49 PM) yohoho@jabber.ccc.de: grep 
(10:11:51 PM) yohoho@jabber.ecc.de: lol whatevs 

(10:11:53 PM) leondavidson@jabber.org/jabber.org: so don't get shocked by it 

(10:1 1:56 PM) yohoho@jabber.ccc,de: poor kayla =(( 

(10:12:02 PM) leondavidson@jabber,org/jabber.org: kayla was hardcore 

(10:12:08 PM) yohoho@jabber.ccc.de: i'm pretty overly the top political 

(10:12:22 PM) yohoho@jabber.ccc.de: I never really had a chance to know kayla too well 

(10:12:33 PM) leo*idavidson@jabber.org/jabber.org: its a shame, you would have had a blast 

(10:29:35 PM) Ieondavidson@jahber.org/12500a942dbfc674: not for nothing but I think owning 

law firms involved in big cases is probably a good direction 

(10:29:39 PM) Ieondavidson@jabber.org/12500a942dbfc674: imagine the wealth of intimation 
(10:29:44 PM) yohoho@jabberxcc.de: I agree 

(10:29:55 PM) yohoho@jabber.ccc.de: Let's try to fnd some firms specializing in IP 
(10:30:03 PM) yohoho@jabber.ccc.de: Dirty bastards 
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(10:30:21 PM) Ieondavidson@jabber.org/12500a942dhfc674; yup 

(10:46:29 PM) Ieondavidson@jabber.org/jabber.org: yo son are we gonna also do^J 

(10:46:37 PM) leondavidson@jabbei\org/jabber.org: might as well do it 

(10:46:42 PM) Ieondavidson@jabbcr..org/jabber.org: since theres nothing on it and we cant 

crack pws 

(10:46:51 PM) yohoho@jabber.ccc.de: hold on give me a good 20-30 or so to get my irl shit 
together here 

(10:46:54 PM) leondavidson@jabber.org/jabber.org: its possible those passwords are randomly 
generated, or they're using o standards 

(10:46:58 PM) leondavidson^jabber.org/jahber.org: ok no problem.. 

(10:47:00 PM) yohoho@jabber.ccc.de: I have reason tot hink we should wait a bit on that as well 

(10:47:04 PM) Ieondavid8on@jabber,org/jabber.org: got u 

(10:47:07 PM) yohoho@jabber.ccc.de: but we'll talk about it 

(10:47:08 PM) leondavidson@jabber.org/jabber.org: you ok bro? 

(10:47:15 PM) yohoho@Jabber.ccc.de: oh yah 

(10:47:18 PM) !eoiidavids0n@jabber.org/jabber.©rg: kk 

(i 1 :03:37 PM) Ieondavidson@jabber,org/jabber.org: yo brother 

(H:03:45 PM) leondaYidson@jabber,org/jabber.org: personal favour fromB Hiacka s: 



(1 1:03:49 PM) leondavidson@jabbcr.org/jabber.org: plz tell me you can get that 
(11:03:58 PM) yohoho@j abber.ccc.de: give me 2 and Til check 
(1 1:04:09 PM) leondaviclson@jabber.org/jabber,org 
( 1 1 :07:i 8 pm) lgondavidson@jabber.org/jabbgM 
well, but I he( J^ne is win. also yo u got | M i : 

(11:07:48 PM) yohoho@jabber.ccc.de: ■fl|H^ otec * ~) 
(1 1:07:50 PM) yohoho@jabber.ccc.de: 2 domains, Omai^ 
(1 1:08:06 PM) yohoho@jabber.ccc.de: yes we got I 




as 




for personal 



(1 1:08:35 PM) leondavidson^jabber.org/jabber.org; great. I'll see if I can bd| 
shit 

(11:08:36 PM) leoiKlavidson@jabber.org/jabheir.Grg: :X 
(11:09:37 PM) yohoho@jabber.ccc.de: ok| ftjootcd 
(11:10:17 PM) yohoho@jabber.ccc.de: so istfiat^^Jone 

(11:10:17 PM) yohoho@jabber.ccc.de: btw 

(11:10:21 PM)leondavidson@jabber.org/jabber.org: yoh 

(11:10:27 PM) yohoho@jabber.ccc.de: whenl root them, you can just go to this URL for a shell 
(1 1:10:39 PM) teondavid§on@jabb€r.org/jabber.org: ja give me tht shit so I can fucking 
memorize it 

(11:1 0:49 PM) leoiidavidson@jabber.oag/jabher.©rg; by the time im done with all this shit my 
memory will be faking amazing 
(11:10:56 PM) yohoho@jabber.ccc.de: 1 
(1 1:1 1:08 PM) yohoho@jabber.ccc.de: and iher 
(ll:i 1:15 PM) yohoho@jabber.ccc.de: instant rooF 
(1 1 :l 1 :i 6 PM) leondavidson@jabber,org/jabber.org: yup 
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(1:35:59 AM) Ieondavidson@jabber.org/jabber.org; itll spread 
(1:36:01 AM) leoiidavidson@jabber.org/jabber.org: feel me 
(3:36:02 AM) yohoho@jabber.ccc,de: eh the work is done 
(1:36:04 AM) yohoho@jabber.ccc.de: we got other shit 
0 :36:09 AM) yohoho@jabbcr.ccc.de: this new one is much more significant 
(l :36: 15 AM) yohoho@jabber.ccc.de: it is the largest war crimes trial to come out of I 
(1:36:23 AM) Ieondavidson@jabber.org/jabber.org: :* 
(1:36:33 AM) yohoho@jabber.ccc.de: ;) 

(1:46:00 AM) leondavidson@jabber.org/jabber,org: ■ (computer club, their 

next meeting includes a CISSP chief security officer ij 
(1:50:14 AM) 3eondavidson@jabber.ore/iaW)er.org: 
(1:51:37 AM) yohoho@jabber.ccc.de:| 
(1:51:38 AM) yohoho@jabbcr.ccc.dey^^^^^^^_ 
(1:52:24 AM) yohoho(^jabbcr.ccc.de| |is good tho 

(1:52:28 AM) yohoho@jabber.ccc.de; looks like nothin on it 
(1:52:31 AM) yohoho@jabber.ccc.de: rooted 

0 :52:44 am) leondavsd$on@jahber«org/jabber.org: kk just lookin through shit 
(1 :53:50 AM) yohoho@jabber.ccc.de: moar the mierrier +!) 
(i :54:0l AM) yohoho@jabber.ccc.de: ok all emails uploaded 
(J :54;05 AM) yohoho@jabbcr.ccc.de: now to render and then copy 
(] ;54:08 AM) yohoho@jabber.cccde: then we make j 

;S4:l6 AK4\ 1cowdfl.vidsnnfSrj ahhfir.nrg/jahher.nrg; I 



ber.org/jabber.org: 




(l :55:37 AM) yohoho@jabber.ccc.de: damn you relentless 
(1 :55:38 AM) yohoho@jabber.ccc.de: but this is good 
(1 :55:43 AM) yohoho@jabber.ccc.de: I can't wait to see the scan report of 
(1 :55:46 AM) yohoho@jabber.ccc.de: They have FUCKLOADS of big customers. 
(1:55:55 AM) yohoho@jabber.ccc.de: I literally just scanned a few targets and found 
crimestoppers. 

(1:55:56 AM) yohoho@jabber.ccc.de: LOL 

(1:56:21 AM) Ieondavidson@jabhei\org/jabber.org: LOLLLLLLLLLLLLL 

(1:56:39 AM) yohoho@jabber.ccc.de: unfortunately the report a crime feature is offsite 

(1:56:42 AM) yohoho@jabber.ccc.de: but we can rewrite the form 

(1 :56:46 AM) yohoho@jabber.ccc.de: it'll get noticed eventually but whatevs =) 

(1:56:47 AM) 3eondavidson@jabber.org/jahber.org: jea 

(!:56:5l AM) ieQndavid$oft@jabber.org/jabher.org: ;] 

(1:56:58 AM) yohoho@jabber.ccc.de: it's worth doing it just to do it 

(] :57:ii AM) yohoho@jabber.ccc.de: add another target to this bigass major police ownign I 
have planned 

(2:00:47 AM) ieondavidson@jabber.org/]abber.org:| 
(2:01:15 AM) yohoho@jabber.ccc.de: oh nice 
(2:02:06 AM) yohoho@jabber.ccc.de: ugh mssql 
(2:02:09 AM) yohoho@jabber.ccc.de: but we can getpassies 
(2:02:43 AM) Ieondavldson@jabber,org/jabber.org: yup 
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(2;03:45 AM) yohoho@jabber.ccc.de: hey try to find more m^rgcts 
(2:04.38 AM) leondavidson@jabber.org/jabber.org; got you 
(2:08:37 AM) Ieoiidavidson@jabber.org/jabber.org; theres endless ■ Btargets 
(2:08:49 AM) yohoho@jabber.ccc.de: nice nice 
(2:08:51 AM) yohoho@jabber.ccc.de: get em all 
(2:08:53 AM) yohoho@jabber.ccc.de: they gonna wage war 
(2:09:07 AM) Ieondavidsoii@jabber.org/jabbenorg: kk 
(2:09: f 2 AM) teondavidson@jabber.org/jabber.org: 
start 

(2:09:17 AM) leondavidson@jabber.0rg/jabi>er.0rg: im going to grab everything i can brb 
(2:09:18 AM) yohoho@jabber.ccc.de: woahhhh 
(2:09:19 AM) yohoho@jabber.ccc.de: nice. 

(2:09:45 AM) yohoho@jabber.ccc.de: aw damn not v uln. 

davidson@jabber.org/jabber.org:| (security 





(2; 12:22 AM) yohoho@jabber.ccc.de: nice 
(2:12:24 AM) yohoho@jabber.ccc.de; they will be hap 
(2:12:48 AM) leondavidson@jabber.org/jabber.org: [ 

(2:13:01 AM) feondavidson@jabber.org/jabber.org:| 

(2:16:28 AM) yohoho@jabber,ccc.de: all of those rooted except news 
(2:16:33 AM) yohoho@jabber.ccc.de: good work 
(2:16:36 AM) yohoho@jabber.ccc.de: this is probably good for now 
(2: 16:44 AM) yohoho@jabber.ccc.de: keep lookin for others though if you like 
(2:16:51 AM) yohoho@jabber.ccc.de: in 30 I will ha ve spools for you to rev iew on this leak 
(2:17:20 AM) leondavidson@jabber.org/jaM)er.org:| Jlomain registrar 

(2:17:23 AM) Ieondavidson@jabber.org/jabber.0rg; thats always win 
(2:17:54 AM) yohoho@jabber.ccc.de: oh shit 
(2:18:09 am) yohoho@jabber.ccc.de: dman not vuln. 

(2:19:22 AM) koadavid$on@jabber.org/jabber.{»'<j>| | it companyl 

= it news site i^^^^^^^^^^^™ 

(2:20:28 AM) )ft)ndavidson@jahbei\org/ja bber.org; II demo box on a 
hi g ■ lisp, if they're smart they mide be abte to traveT TacTcwa^ network 
(li'm^M) yohoho@jabber.ccc.de: ahyefl |also hosted ministryofjustice 



(2:21:46 AM) yohoho@jabber.ccc.de: maybe i wiu set. mem up a pirate node on that box 
(2:21:57 AM) vohoho{a;iabber.ccc.de; if it's linux 
(2:22:05 AMI vohohof@iabber.ccc.deJ ^^^^ 

~ onl I a2t ain tno good 
(2:22:06 AM) leondavjdson@jabbcr,org/jam?er!<?g: goochiew^ 
(£2237 AM) leonda^dscu^)jabber.org/jabber.org: ' 

Server for ■ 1 restaurant 

(2:22:35 AM) yohoho@jabber.ccc.de: lol 
(2:22:38 AM) yohoho@jabber.ccc.de: losers 
(2:22,38 AM) Seointdavidson@jabber.©rg/jabher.org: ;) 
(2:22:41 AM) leondavidson@jabber.org/jabber.0rg: thats - nice 



I - win. its the official 
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(2:22:57 AM) yohoho@jabber.ccc.de: not vuln 

(2:22:59 AM) yohoho@jabber.ccc.de: are they same server? 

(2:23:02 AM) leondavidson@jabber.©rg/jabhcr.org: fucck 

(2:23: i ] A M) ] eon d s v idson@ja bber.or^j^Mty^prg: it redirects, try em both you never know 
(2:23:19 AM) yohoho@jabber.ccc.de; | |tint runnin plcsk 
(2:23:22 AM) yohoho@jabber.ccc.de: it's proliy redir 
(2:23:28 AM) yohoho@jabbcr.ccc.de: igif is but aint 

(2:25:ii AM) leondavidson@jabber.org/jabber.org; | | insiuancc 

company _ _ 

(2:28:04 AM) Iconda\ idson@jsibber .*ir«/];i^i7cr.orj»H Biorts stadium 

(2:28:30 AM) ieondavidsoK{S-|abber,org/jabber.orgfl B- satelite uplink 

consultants 

(2:28:39 AM) Ieondavids0n@jahber o arg/jabber.org: if their mails are juicy enough we might be 
able to access their satelites ^^^^^^^^^^m 

(2:29:06 AM) leoridavid$oii@jabber.0rg/jabber.org:( H^S server host 

(2:29:13 AM) yohoho@jabber.ccc.de: darn no fade 
(2:29: IS AM) leondavidson@:iabber.o rg/iabbcr.oi'g: damn 
(2:29:40 AM) yohoho@iabber.ccc.dc: I 



: AM) yonoiio(a?jai>oer.ccc.de: on stadium 
(2:31:15 AM) ieQndavidson@jabber.org/jabber.org: unf 
(2:32:31 AM) yohoho@jabber.ccc.de: uited, stadium, ans rooted 



jer.org/jabber.org: kk I was just looking for specific targe 



■ 



(2:33:29 AM) leondavidson@ 

(2:33:38 AM) Ieondavid$on@jabber.org/jabber,org; now im just going to feed you random | 
they may be full of good shit 
(2:33:42 AM) yohoho@jabber.ccc.de: k 
(2:33:54 AM) yohoho@jabber.ccc.de: honestly hough 
(2:33:56 AM) yohoho@jabber.ccc.de: this is plenty for now 
(2:34:00 AM) leondavids0it@jabber.0rg/jabber.org: ok 
[2:34:02 AM) Ieondavidsora@jabuer.org/jabber.<>rg: got you 
(2:34:03 AM) yohoho@jabber.ccc.de: maybe find a different range of targets 
(2:34:08 AM) yohoho@jabber.ccc.de: industries.... intellectual property firms 
(2:34:20 AM) le0Rdavid$on@jabber.org/jabber.org; kk 

(2:34:24 AM) yohoho@jabber.ccc.de: basicly I think we should line up as many IP related targets 
(2:34:33 AM) yohoho@jabber.ccc.de: then when they make another megaupload type move we 
will have it all ready 

(2:40:10 AM) leondavidson@jabber.org/jabber.org: yup 

(2:42: 16 AM) ieondavidson^abber.org/jabber.org: PUP 5.3.10 Released! [02-Feb-2012] The 

PHP development team would like to announce the immediate availability of PHP 5.3-10. This 

release delivers a critical security fix. Security Fixes in PHP 5.3. 10: Fixed arbitrary remote code 

execution vulnerability reported by Stefan Esser, CVE-2012-0830. 

12:42:20 AM) leondavidson^j&bber.org/jabber.org: 2012 is a great year so far 

(2:42:29 AM) Ieoodavidson@j&bber.org/jabber.0rg: also kingcope sent us a message through 
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